require AntiForgery on Static Rendered components

oqtane · May 8, 2024 · bf4052b · bf4052b
1 parent f789582
commit bf4052b
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 0 deletions.
diff --git a/Oqtane.Server/Extensions/ComponentEndpointRouteBuilderExtensions.cs b/Oqtane.Server/Extensions/ComponentEndpointRouteBuilderExtensions.cs
@@ -5,6 +5,7 @@
 using System;
 using Microsoft.AspNetCore.Builder;
 using Microsoft.Extensions.DependencyInjection;
+using Microsoft.AspNetCore.Antiforgery;
 
 namespace OqtaneSSR.Extensions
 {
@@ -23,6 +24,7 @@ public static void MapFallback(this IEndpointRouteBuilder endpoints)
             {
                 routeEndpointBuilder.Metadata.Add(new RootComponentMetadata(typeof(App)));
                 routeEndpointBuilder.Metadata.Add(new ComponentTypeMetadata(typeof(App)));
+                routeEndpointBuilder.Metadata.Add(new RequireAntiforgeryTokenAttribute());
             });
         }
     }

diff --git a/Oqtane.Server/Startup.cs b/Oqtane.Server/Startup.cs
@@ -216,6 +216,7 @@ public void Configure(IApplicationBuilder app, IWebHostEnvironment env, ISyncMan
             app.UseCors();
             app.UseAuthentication();
             app.UseAuthorization();
+            app.UseAntiforgery();
 
             if (_useSwagger)
             {