Auto set antiforgery cookie

framework/src/Volo.Abp.AspNetCore.Mvc.UI.Theme.Basic/Themes/Basic/Layouts/Account.cshtml

@@ -13,7 +13,6 @@
 @using Volo.Abp.AspNetCore.Mvc.UI.Widgets.Components.WidgetStyles
 @using Volo.Abp.MultiTenancy
 @using Volo.Abp.Localization
-@inject IAbpAntiForgeryManager AbpAntiForgeryManager
 @inject IBrandingProvider BrandingProvider
 @inject IOptions<AbpMultiTenancyOptions> MultiTenancyOptions
 @inject ICurrentTenant CurrentTenant
@@ -22,7 +21,6 @@
 
 @{
     Layout = null;
-    AbpAntiForgeryManager.SetCookie();
     var containerClass = ViewBag.FluidLayout == true ? "container-fluid" : "container"; //TODO: Better and type-safe options
     var rtl = CultureHelper.IsRtl ? "rtl" : string.Empty;
 }

framework/src/Volo.Abp.AspNetCore.Mvc.UI.Theme.Basic/Themes/Basic/Layouts/Application.cshtml

@@ -9,12 +9,10 @@
 @using Volo.Abp.AspNetCore.Mvc.UI.Widgets.Components.WidgetScripts
 @using Volo.Abp.AspNetCore.Mvc.UI.Widgets.Components.WidgetStyles
 @using Volo.Abp.Localization
-@inject IAbpAntiForgeryManager AbpAntiForgeryManager
 @inject IBrandingProvider BrandingProvider
 @inject IPageLayout PageLayout
 @{
     Layout = null;
-    AbpAntiForgeryManager.SetCookie();
     var containerClass = ViewBag.FluidLayout == true ? "container-fluid" : "container"; //TODO: Better and type-safe options
 
     var pageTitle = ViewBag.Title == null ? BrandingProvider.AppName : ViewBag.Title; //TODO: Discard to get from Title

framework/src/Volo.Abp.AspNetCore.Mvc.UI.Theme.Basic/Themes/Basic/Layouts/Empty.cshtml

@@ -8,12 +8,10 @@
 @using Volo.Abp.AspNetCore.Mvc.UI.Widgets.Components.WidgetScripts
 @using Volo.Abp.AspNetCore.Mvc.UI.Widgets.Components.WidgetStyles
 @using Volo.Abp.Localization
-@inject IAbpAntiForgeryManager AbpAntiForgeryManager
 @inject IBrandingProvider BrandingProvider
 @inject IPageLayout PageLayout
 @{
     Layout = null;
-    AbpAntiForgeryManager.SetCookie();
     var containerClass = ViewBag.FluidLayout == true ? "container-fluid" : "container"; //TODO: Better and type-safe options
 
     var pageTitle = ViewBag.Title == null ? BrandingProvider.AppName : ViewBag.Title; //TODO: Discard to get from Title

framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AbpAntiForgeryAuthCookieNameProvider.cs

@@ -19,7 +19,7 @@ namespace Volo.Abp.AspNetCore.Mvc.AntiForgery
 
         public virtual string GetNameOrNull()
         {
-            return _namedOptionsAccessor.Get(_abpAntiForgeryOptions.AuthCookieName)?.Cookie?.Name;
+            return _namedOptionsAccessor.Get(_abpAntiForgeryOptions.AuthCookieSchemaName)?.Cookie?.Name;
         }
     }
 }

framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AbpAntiForgeryManagerAspNetCoreExtensions.cs

@@ -4,7 +4,11 @@
     {
         public static void SetCookie(this IAbpAntiForgeryManager manager)
         {
-            manager.HttpContext.Response.Cookies.Append(manager.Options.TokenCookieName, manager.GenerateToken());
+            manager.HttpContext.Response.Cookies.Append(
+                manager.Options.TokenCookie.Name,
+                manager.GenerateToken(),
+                manager.Options.TokenCookie.Build(manager.HttpContext)
+            );
         }
     }
-}
+}

framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AbpAntiForgeryOptions.cs

@@ -1,23 +1,33 @@
-namespace Volo.Abp.AspNetCore.Mvc.AntiForgery
+using System;
+using Microsoft.AspNetCore.Http;
+
+namespace Volo.Abp.AspNetCore.Mvc.AntiForgery
 {
     public class AbpAntiForgeryOptions
     {
         /// <summary>
-        /// Get/sets cookie name to transfer Anti Forgery token between server and client.
-        /// Default value: "XSRF-TOKEN".
+        /// Use to set the cookie options to transfer Anti Forgery token between server and client.
+        /// Default name of the cookie: "XSRF-TOKEN".
         /// </summary>
-        public string TokenCookieName { get; set; }
+        public CookieBuilder TokenCookie { get; }
 
         /// <summary>
         /// Used to find auth cookie when validating Anti Forgery token.
-        /// Default value: ".AspNetCore.Identity.Application".
+        /// Default value: "Identity.Application".
         /// </summary>
-        public string AuthCookieName { get; set; }
+        public string AuthCookieSchemaName { get; set; }
 
         public AbpAntiForgeryOptions()
         {
-            TokenCookieName = "XSRF-TOKEN";
-            AuthCookieName = ".AspNetCore.Identity.Application";
+            TokenCookie = new CookieBuilder
+            {
+                Name = "XSRF-TOKEN",
+                HttpOnly = false,
+                IsEssential = true,
+                Expiration = TimeSpan.FromDays(3650) //10 years!
+            };
+
+            AuthCookieSchemaName = "Identity.Application";
         }
     }
 }

framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AbpValidateAntiforgeryTokenAuthorizationFilter.cs

@@ -6,10 +6,11 @@ using Microsoft.AspNetCore.Mvc.Filters;
 using Microsoft.AspNetCore.Mvc.ViewFeatures;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;
+using Volo.Abp.DependencyInjection;
 
 namespace Volo.Abp.AspNetCore.Mvc.AntiForgery
 {
-    public class AbpValidateAntiforgeryTokenAuthorizationFilter : IAsyncAuthorizationFilter, IAntiforgeryPolicy
+    public class AbpValidateAntiforgeryTokenAuthorizationFilter : IAsyncAuthorizationFilter, IAntiforgeryPolicy, ITransientDependency
     {
         private IAntiforgery _antiforgery;
         private readonly AntiforgeryOptions _antiforgeryOptions;

framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AspNetCoreAbpAntiForgeryManager.cs

@@ -26,7 +26,11 @@ namespace Volo.Abp.AspNetCore.Mvc.AntiForgery
 
         public void SetCookie()
         {
-            HttpContext.Response.Cookies.Append(Options.TokenCookieName, GenerateToken());
+            HttpContext.Response.Cookies.Append(
+                Options.TokenCookie.Name,
+                GenerateToken(),
+                Options.TokenCookie.Build(HttpContext)
+            );
         }
 
         public string GenerateToken()
@@ -34,4 +38,4 @@ namespace Volo.Abp.AspNetCore.Mvc.AntiForgery
             return _antiforgery.GetAndStoreTokens(_httpContextAccessor.HttpContext).RequestToken;
         }
     }
-}
+}

framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/ApplicationConfigurations/AbpApplicationConfigurationController.cs

@@ -1,5 +1,6 @@
 using System.Threading.Tasks;
 using Microsoft.AspNetCore.Mvc;
+using Volo.Abp.AspNetCore.Mvc.AntiForgery;
 
 namespace Volo.Abp.AspNetCore.Mvc.ApplicationConfigurations
 {
@@ -9,17 +10,21 @@ namespace Volo.Abp.AspNetCore.Mvc.ApplicationConfigurations
     public class AbpApplicationConfigurationController : AbpController, IAbpApplicationConfigurationAppService
     {
         private readonly IAbpApplicationConfigurationAppService _applicationConfigurationAppService;
+        private readonly IAbpAntiForgeryManager _antiForgeryManager;
 
         public AbpApplicationConfigurationController(
-            IAbpApplicationConfigurationAppService applicationConfigurationAppService)
+            IAbpApplicationConfigurationAppService applicationConfigurationAppService,
+            IAbpAntiForgeryManager antiForgeryManager)
         {
             _applicationConfigurationAppService = applicationConfigurationAppService;
+            _antiForgeryManager = antiForgeryManager;
         }
 
         [HttpGet]
         public async Task<ApplicationConfigurationDto> GetAsync()
         {
+            _antiForgeryManager.SetCookie();
             return await _applicationConfigurationAppService.GetAsync();
         }
     }
-}
+}

framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/ApplicationConfigurations/AbpApplicationConfigurationScriptController.cs

@@ -2,6 +2,7 @@
 using System.Threading.Tasks;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.Options;
+using Volo.Abp.AspNetCore.Mvc.AntiForgery;
 using Volo.Abp.Auditing;
 using Volo.Abp.Http;
 using Volo.Abp.Json;
@@ -20,17 +21,20 @@ namespace Volo.Abp.AspNetCore.Mvc.ApplicationConfigurations
         private readonly IJsonSerializer _jsonSerializer;
         private readonly AbpAspNetCoreMvcOptions _options;
         private readonly IJavascriptMinifier _javascriptMinifier;
+        private readonly IAbpAntiForgeryManager _antiForgeryManager;
 
         public AbpApplicationConfigurationScriptController(
             IAbpApplicationConfigurationAppService configurationAppService,
             IJsonSerializer jsonSerializer,
             IOptions<AbpAspNetCoreMvcOptions> options,
-            IJavascriptMinifier javascriptMinifier)
+            IJavascriptMinifier javascriptMinifier,
+            IAbpAntiForgeryManager antiForgeryManager)
         {
             _configurationAppService = configurationAppService;
             _jsonSerializer = jsonSerializer;
             _options = options.Value;
             _javascriptMinifier = javascriptMinifier;
+            _antiForgeryManager = antiForgeryManager;
         }
 
         [HttpGet]
@@ -39,6 +43,8 @@ namespace Volo.Abp.AspNetCore.Mvc.ApplicationConfigurations
         {
             var script = CreateAbpExtendScript(await _configurationAppService.GetAsync());
 
+            _antiForgeryManager.SetCookie();
+
             return Content(
                 _options.MinifyGeneratedScript == true
                     ? _javascriptMinifier.Minify(script)