Antiforgery validation failure returns 400 Bad Request for Controllers and 500 Internal Server Error for minimal APIs
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 10h
- Merged PRs (30d)
- 281
Description
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Describe the bug
There's a difference in antiforgery prevention response between classic MVC and API controllers and minimal APIs.
* Controller: 400 Bad Request
* Minimal API: 500 Internal Server Error
### Expected Behavior
I expect the antiforgery validation failure response to be consistent between backend implementations so that I can write a frontend that is ignorant of the technology used in the backend.
### Steps To Reproduce
**Controller**
```csharp
[ApiController]
[Route("example-1")]
public class AntiforgeryExampleController : ControllerBase
{
[HttpPost]
[RequireAntiforgeryToken]
public IActionResult Post(IFormFile file)
{
return Ok();
}
}
```
```json
{
"type": "https://tools.ietf.org/html/rfc9110#section-15.5.1",
"title": "Bad Request",
"status": 400
}
```
**Minimal API**
```csharp
app.MapPost("example-2", (IFormFile file) => Results.Ok());
```
```json
{
"type": "https://tools.ietf.org/html/rfc9110#section-15.6.1",
"title": "An error occurred while processing your request.",
"status": 500
}
```
### Exceptions (if any)
_No response_
### .NET Version
8.0.403
### Anything else?
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.