diff --git a/docs/en/Best-Practices/Application-Services.md b/docs/en/Best-Practices/Application-Services.md
index b14770d654..ff8afe81d2 100644
--- a/docs/en/Best-Practices/Application-Services.md
+++ b/docs/en/Best-Practices/Application-Services.md
@@ -215,9 +215,8 @@ This method votes a question and returns the current score of the question.
#### Handle files
-* **Do not** use any file-related components(like `IFormFile`) or `Stream` in the application service interface. You can use primitive types as file parameters. Such as `byte[]`.
-* **Do** use a controller to handle file upload and call a application service method.
-
+* **Do not** use any web components like `IFormFile` or `Stream` in the application services. If you want to serve a file you can use `byte[]`.
+* **Do** use a `Controller` to handle file uploading then pass the `byte[]` of the file to the application service method.
#### Using Other Application Services
diff --git a/docs/en/UI/AspNetCore/Tag-Helpers/Badges.md b/docs/en/UI/AspNetCore/Tag-Helpers/Badges.md
index 66727cc112..c627273062 100644
--- a/docs/en/UI/AspNetCore/Tag-Helpers/Badges.md
+++ b/docs/en/UI/AspNetCore/Tag-Helpers/Badges.md
@@ -2,11 +2,11 @@
## Introduction
-`abp-badge` and `abp-badge-pill` are abp tags for badges.
+`abp-badge` and `abp-badge-pill` are ABP Tag Helper attributes for `a` and `span` html tags.
Basic usage:
-````csharp
+````html
PrimaryInfoDanger
@@ -22,8 +22,7 @@ See the [badges demo page](https://bootstrap-taghelpers.abp.io/Components/Badges
* Indicates the type of the badge. Should be one of the following values:
- * `_` (default value)
- * `Default` (default value)
+ * `Default`
* `Primary`
* `Secondary`
* `Success`
@@ -35,6 +34,7 @@ See the [badges demo page](https://bootstrap-taghelpers.abp.io/Components/Badges
Example:
-````csharp
+````html
Danger
````
+
diff --git a/docs/en/UI/AspNetCore/Tag-Helpers/Blockquote.md b/docs/en/UI/AspNetCore/Tag-Helpers/Blockquote.md
new file mode 100644
index 0000000000..a63187aeb3
--- /dev/null
+++ b/docs/en/UI/AspNetCore/Tag-Helpers/Blockquote.md
@@ -0,0 +1,18 @@
+# Blockquote
+
+`abp-blockquote` is the main container for blockquote items.
+
+Basic usages:
+
+````html
+
+
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Integer posuere erat a ante.
+
+
+
+
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Integer posuere erat a ante.
+
+
+````
+
+It adds `blockquote` class to main container, also adds `blockquote-footer` class to inner `footer` element and `mb-0` class to inner `p` element.
\ No newline at end of file
diff --git a/docs/en/UI/AspNetCore/Tag-Helpers/Borders.md b/docs/en/UI/AspNetCore/Tag-Helpers/Borders.md
index 1dc070e8ad..e1d98ac7d8 100644
--- a/docs/en/UI/AspNetCore/Tag-Helpers/Borders.md
+++ b/docs/en/UI/AspNetCore/Tag-Helpers/Borders.md
@@ -2,11 +2,11 @@
## Introduction
-`abp-border` is a main element for border styling.
+`abp-border` is ABP Tag Helper attribute for border styling.
Basic usage:
-````csharp
+````html
@@ -124,3 +124,5 @@ A value indicates type, position and the color of the border. Should be one of t
* `Bottom_Light_0`
* `Bottom_Dark_0`
* `Bottom_White_0`
+
+(Values with `_0` at the end is for [Subtractive](https://getbootstrap.com/docs/4.0/utilities/borders/#subtractive) usages)
\ No newline at end of file
diff --git a/docs/en/UI/AspNetCore/Tag-Helpers/Breadcrumbs.md b/docs/en/UI/AspNetCore/Tag-Helpers/Breadcrumbs.md
index 59332cf8de..b7082696c5 100644
--- a/docs/en/UI/AspNetCore/Tag-Helpers/Breadcrumbs.md
+++ b/docs/en/UI/AspNetCore/Tag-Helpers/Breadcrumbs.md
@@ -6,7 +6,7 @@
Basic usage:
-````csharp
+````html
diff --git a/docs/en/UI/AspNetCore/Tag-Helpers/Button-groups.md b/docs/en/UI/AspNetCore/Tag-Helpers/Button-groups.md
index 93865e0d74..bfd558f89e 100644
--- a/docs/en/UI/AspNetCore/Tag-Helpers/Button-groups.md
+++ b/docs/en/UI/AspNetCore/Tag-Helpers/Button-groups.md
@@ -6,7 +6,7 @@
Basic usage:
-````csharp
+````html
LeftMiddle
diff --git a/docs/en/UI/AspNetCore/Tag-Helpers/Carousel.md b/docs/en/UI/AspNetCore/Tag-Helpers/Carousel.md
index 6088977068..3b91087838 100644
--- a/docs/en/UI/AspNetCore/Tag-Helpers/Carousel.md
+++ b/docs/en/UI/AspNetCore/Tag-Helpers/Carousel.md
@@ -6,7 +6,7 @@
Basic usage:
-````csharp
+````html
diff --git a/docs/en/UI/AspNetCore/Tag-Helpers/Collapse.md b/docs/en/UI/AspNetCore/Tag-Helpers/Collapse.md
index 38fab4d44b..dfbe8ea248 100644
--- a/docs/en/UI/AspNetCore/Tag-Helpers/Collapse.md
+++ b/docs/en/UI/AspNetCore/Tag-Helpers/Collapse.md
@@ -6,7 +6,7 @@
Basic usage:
-````xml
+````html
Link with href
diff --git a/docs/en/UI/AspNetCore/Tag-Helpers/Figure.md b/docs/en/UI/AspNetCore/Tag-Helpers/Figure.md
new file mode 100644
index 0000000000..e3b0e0d0a4
--- /dev/null
+++ b/docs/en/UI/AspNetCore/Tag-Helpers/Figure.md
@@ -0,0 +1,14 @@
+# Figures
+
+`abp-figure` is the main container for bootstrap figure items.
+
+Basic usage:
+
+````html
+
+
+ A caption for the above image.
+
+````
+
+It adds `figure` class to main container, also adds `figure-img` class to inner `abp-image` element and `figure-caption` class to inner `abp-figcaption` element.
\ No newline at end of file
diff --git a/docs/en/UI/AspNetCore/Tag-Helpers/Index.md b/docs/en/UI/AspNetCore/Tag-Helpers/Index.md
index 229460de92..54c37af688 100644
--- a/docs/en/UI/AspNetCore/Tag-Helpers/Index.md
+++ b/docs/en/UI/AspNetCore/Tag-Helpers/Index.md
@@ -13,19 +13,26 @@ ABP Framework also adds some **useful features** to the standard bootstrap compo
Here, the list of components those are wrapped by the ABP Framework:
* [Alerts](Alerts.md)
+* [Badges](Badges.md))
+* [Blockquote](Blockquote.md)
+* [Borders](Borders.md)
+* [Breadcrumb](Breadcrumb.md)
* [Buttons](Buttons.md)
* [Cards](Cards.md)
+* [Carousel](Carousel.md)
* [Collapse](Collapse.md)
* [Dropdowns](Dropdowns.md)
+* [Figures](Figure.md)
* [Grids](Grids.md)
* [List Groups](List-Groups.md)
* [Modals](Modals.md)
+* [Navigation](Navs.md)
* [Paginator](Paginator.md)
* [Popovers](Popovers.md)
* [Progress Bars](Progress-Bars.md)
+* [Tables](Tables.md)
* [Tabs](Tabs.md)
* [Tooltips](Tooltips.md)
-* ...
> Until all the tag helpers are documented, you can visit https://bootstrap-taghelpers.abp.io/ to see them with live samples.
diff --git a/docs/en/UI/AspNetCore/Tag-Helpers/Navs.md b/docs/en/UI/AspNetCore/Tag-Helpers/Navs.md
index c7503fa51d..9c8347b831 100644
--- a/docs/en/UI/AspNetCore/Tag-Helpers/Navs.md
+++ b/docs/en/UI/AspNetCore/Tag-Helpers/Navs.md
@@ -6,7 +6,7 @@
Basic usage:
-````csharp
+````html
Active
@@ -78,7 +78,7 @@ See the [navs demo page](https://bootstrap-taghelpers.abp.io/Components/Navs) to
Example:
-````csharp
+````html
Navbar
diff --git a/docs/en/UI/AspNetCore/Tag-Helpers/Paginator.md b/docs/en/UI/AspNetCore/Tag-Helpers/Paginator.md
index 9969bcf3cc..c30e68eed9 100644
--- a/docs/en/UI/AspNetCore/Tag-Helpers/Paginator.md
+++ b/docs/en/UI/AspNetCore/Tag-Helpers/Paginator.md
@@ -12,7 +12,7 @@ Basic usage:
Model:
-````xml
+````csharp
using Microsoft.AspNetCore.Mvc.RazorPages;
using Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Pagination;
diff --git a/docs/en/UI/AspNetCore/Tag-Helpers/Tables.md b/docs/en/UI/AspNetCore/Tag-Helpers/Tables.md
index 50e6c3baf9..db30db6a09 100644
--- a/docs/en/UI/AspNetCore/Tag-Helpers/Tables.md
+++ b/docs/en/UI/AspNetCore/Tag-Helpers/Tables.md
@@ -6,7 +6,7 @@
Basic usage:
-````csharp
+````html
diff --git a/docs/zh-Hans/UI/AspNetCore/Customization-User-Interface.md b/docs/zh-Hans/UI/AspNetCore/Customization-User-Interface.md
index 7daf6c5d4b..c94c29d27f 100644
--- a/docs/zh-Hans/UI/AspNetCore/Customization-User-Interface.md
+++ b/docs/zh-Hans/UI/AspNetCore/Customization-User-Interface.md
@@ -70,7 +70,7 @@ namespace Acme.BookStore.Web.Pages.Identity.Users
在这种情况下;
-1. 像上面描述过的那术重写C#页面模型类,但不需要替换已存在的页面模型类.
+1. 像上面描述过的那样重写C#页面模型类,但不需要替换已存在的页面模型类.
2. 像上面描述过的那样重写Razor页面,并且更改@model指向新的页面模型
#### 示例
diff --git a/framework/src/Volo.Abp.AspNetCore.Components.WebAssembly/Volo/Abp/AspNetCore/Components/WebAssembly/AbpBlazorClientHttpMessageHandler.cs b/framework/src/Volo.Abp.AspNetCore.Components.WebAssembly/Volo/Abp/AspNetCore/Components/WebAssembly/AbpBlazorClientHttpMessageHandler.cs
index 7d59042806..1b5c5893d5 100644
--- a/framework/src/Volo.Abp.AspNetCore.Components.WebAssembly/Volo/Abp/AspNetCore/Components/WebAssembly/AbpBlazorClientHttpMessageHandler.cs
+++ b/framework/src/Volo.Abp.AspNetCore.Components.WebAssembly/Volo/Abp/AspNetCore/Components/WebAssembly/AbpBlazorClientHttpMessageHandler.cs
@@ -17,7 +17,7 @@ namespace Volo.Abp.AspNetCore.Components.WebAssembly
_jsRuntime = jsRuntime;
}
- protected override async Task SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
+ protected async override Task SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
{
await SetLanguageAsync(request, cancellationToken);
diff --git a/framework/src/Volo.Abp.AspNetCore.Mvc.UI.Bootstrap/TagHelpers/Button/AbpButtonTagHelperServiceBase.cs b/framework/src/Volo.Abp.AspNetCore.Mvc.UI.Bootstrap/TagHelpers/Button/AbpButtonTagHelperServiceBase.cs
index ab35dbe804..ff0b9dd34f 100644
--- a/framework/src/Volo.Abp.AspNetCore.Mvc.UI.Bootstrap/TagHelpers/Button/AbpButtonTagHelperServiceBase.cs
+++ b/framework/src/Volo.Abp.AspNetCore.Mvc.UI.Bootstrap/TagHelpers/Button/AbpButtonTagHelperServiceBase.cs
@@ -47,6 +47,7 @@ namespace Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Button
var icon = new TagBuilder("i");
icon.AddCssClass(GetIconClass(context, output));
output.Content.AppendHtml(icon);
+ output.Content.Append(" ");
}
protected virtual string GetIconClass(TagHelperContext context, TagHelperOutput output)
@@ -80,4 +81,4 @@ namespace Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Button
}
}
}
-}
\ No newline at end of file
+}
diff --git a/framework/src/Volo.Abp.AspNetCore.Mvc.UI.Bootstrap/TagHelpers/Modal/AbpModalFooterTagHelperService.cs b/framework/src/Volo.Abp.AspNetCore.Mvc.UI.Bootstrap/TagHelpers/Modal/AbpModalFooterTagHelperService.cs
index 1bc6ab2f3a..31cccf2428 100644
--- a/framework/src/Volo.Abp.AspNetCore.Mvc.UI.Bootstrap/TagHelpers/Modal/AbpModalFooterTagHelperService.cs
+++ b/framework/src/Volo.Abp.AspNetCore.Mvc.UI.Bootstrap/TagHelpers/Modal/AbpModalFooterTagHelperService.cs
@@ -45,12 +45,12 @@ namespace Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Modal
sb.AppendLine(GetSaveButton());
break;
case AbpModalButtons.Save | AbpModalButtons.Cancel:
- sb.AppendLine(GetSaveButton());
sb.AppendLine(GetCancelButton());
+ sb.AppendLine(GetSaveButton());
break;
case AbpModalButtons.Save | AbpModalButtons.Close:
- sb.AppendLine(GetSaveButton());
sb.AppendLine(GetCloseButton());
+ sb.AppendLine(GetSaveButton());
break;
}
@@ -72,6 +72,7 @@ namespace Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.TagHelpers.Modal
element.AddCssClass("btn-primary");
element.Attributes.Add("data-busy-text", _localizer["SavingWithThreeDot"]);
element.InnerHtml.AppendHtml(icon);
+ element.InnerHtml.AppendHtml(" ");
element.InnerHtml.AppendHtml(span);
return element.ToHtmlString();
diff --git a/framework/src/Volo.Abp.AspNetCore.Mvc.UI.Theme.Basic/Themes/Basic/Layouts/Account.cshtml b/framework/src/Volo.Abp.AspNetCore.Mvc.UI.Theme.Basic/Themes/Basic/Layouts/Account.cshtml
index 5fcd5951cd..6ab5267b72 100644
--- a/framework/src/Volo.Abp.AspNetCore.Mvc.UI.Theme.Basic/Themes/Basic/Layouts/Account.cshtml
+++ b/framework/src/Volo.Abp.AspNetCore.Mvc.UI.Theme.Basic/Themes/Basic/Layouts/Account.cshtml
@@ -13,7 +13,6 @@
@using Volo.Abp.AspNetCore.Mvc.UI.Widgets.Components.WidgetStyles
@using Volo.Abp.MultiTenancy
@using Volo.Abp.Localization
-@inject IAbpAntiForgeryManager AbpAntiForgeryManager
@inject IBrandingProvider BrandingProvider
@inject IOptions MultiTenancyOptions
@inject ICurrentTenant CurrentTenant
@@ -22,7 +21,6 @@
@{
Layout = null;
- AbpAntiForgeryManager.SetCookie();
var containerClass = ViewBag.FluidLayout == true ? "container-fluid" : "container"; //TODO: Better and type-safe options
var rtl = CultureHelper.IsRtl ? "rtl" : string.Empty;
}
diff --git a/framework/src/Volo.Abp.AspNetCore.Mvc.UI.Theme.Basic/Themes/Basic/Layouts/Application.cshtml b/framework/src/Volo.Abp.AspNetCore.Mvc.UI.Theme.Basic/Themes/Basic/Layouts/Application.cshtml
index 7b06538510..d3ebd2f57f 100644
--- a/framework/src/Volo.Abp.AspNetCore.Mvc.UI.Theme.Basic/Themes/Basic/Layouts/Application.cshtml
+++ b/framework/src/Volo.Abp.AspNetCore.Mvc.UI.Theme.Basic/Themes/Basic/Layouts/Application.cshtml
@@ -9,12 +9,10 @@
@using Volo.Abp.AspNetCore.Mvc.UI.Widgets.Components.WidgetScripts
@using Volo.Abp.AspNetCore.Mvc.UI.Widgets.Components.WidgetStyles
@using Volo.Abp.Localization
-@inject IAbpAntiForgeryManager AbpAntiForgeryManager
@inject IBrandingProvider BrandingProvider
@inject IPageLayout PageLayout
@{
Layout = null;
- AbpAntiForgeryManager.SetCookie();
var containerClass = ViewBag.FluidLayout == true ? "container-fluid" : "container"; //TODO: Better and type-safe options
var pageTitle = ViewBag.Title == null ? BrandingProvider.AppName : ViewBag.Title; //TODO: Discard to get from Title
diff --git a/framework/src/Volo.Abp.AspNetCore.Mvc.UI.Theme.Basic/Themes/Basic/Layouts/Empty.cshtml b/framework/src/Volo.Abp.AspNetCore.Mvc.UI.Theme.Basic/Themes/Basic/Layouts/Empty.cshtml
index 9871bcbb25..2176782a70 100644
--- a/framework/src/Volo.Abp.AspNetCore.Mvc.UI.Theme.Basic/Themes/Basic/Layouts/Empty.cshtml
+++ b/framework/src/Volo.Abp.AspNetCore.Mvc.UI.Theme.Basic/Themes/Basic/Layouts/Empty.cshtml
@@ -8,12 +8,10 @@
@using Volo.Abp.AspNetCore.Mvc.UI.Widgets.Components.WidgetScripts
@using Volo.Abp.AspNetCore.Mvc.UI.Widgets.Components.WidgetStyles
@using Volo.Abp.Localization
-@inject IAbpAntiForgeryManager AbpAntiForgeryManager
@inject IBrandingProvider BrandingProvider
@inject IPageLayout PageLayout
@{
Layout = null;
- AbpAntiForgeryManager.SetCookie();
var containerClass = ViewBag.FluidLayout == true ? "container-fluid" : "container"; //TODO: Better and type-safe options
var pageTitle = ViewBag.Title == null ? BrandingProvider.AppName : ViewBag.Title; //TODO: Discard to get from Title
diff --git a/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AbpAspNetCoreMvcModule.cs b/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AbpAspNetCoreMvcModule.cs
index 1ceb0bc837..4ac0ac5527 100644
--- a/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AbpAspNetCoreMvcModule.cs
+++ b/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AbpAspNetCoreMvcModule.cs
@@ -22,6 +22,7 @@ using Microsoft.AspNetCore.Routing;
using Microsoft.Extensions.Hosting;
using Microsoft.Extensions.Localization;
using Volo.Abp.ApiVersioning;
+using Volo.Abp.AspNetCore.Mvc.AntiForgery;
using Volo.Abp.AspNetCore.Mvc.ApiExploring;
using Volo.Abp.AspNetCore.Mvc.Conventions;
using Volo.Abp.AspNetCore.Mvc.DataAnnotations;
@@ -95,7 +96,10 @@ namespace Volo.Abp.AspNetCore.Mvc
}
});
- var mvcCoreBuilder = context.Services.AddMvcCore();
+ var mvcCoreBuilder = context.Services.AddMvcCore(options =>
+ {
+ options.Filters.Add(new AbpAutoValidateAntiforgeryTokenAttribute());
+ });
context.Services.ExecutePreConfiguredActions(mvcCoreBuilder);
var abpMvcDataAnnotationsLocalizationOptions = context.Services
diff --git a/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AbpAntiForgeryCookieNameProvider.cs b/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AbpAntiForgeryCookieNameProvider.cs
new file mode 100644
index 0000000000..66cd8701de
--- /dev/null
+++ b/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AbpAntiForgeryCookieNameProvider.cs
@@ -0,0 +1,35 @@
+using Microsoft.AspNetCore.Authentication.Cookies;
+using Microsoft.Extensions.Options;
+using Volo.Abp.DependencyInjection;
+
+namespace Volo.Abp.AspNetCore.Mvc.AntiForgery
+{
+ public class AbpAntiForgeryCookieNameProvider : ITransientDependency
+ {
+ private readonly IOptionsSnapshot _namedOptionsAccessor;
+ private readonly AbpAntiForgeryOptions _abpAntiForgeryOptions;
+
+ public AbpAntiForgeryCookieNameProvider(
+ IOptionsSnapshot namedOptionsAccessor,
+ IOptions abpAntiForgeryOptions)
+ {
+ _namedOptionsAccessor = namedOptionsAccessor;
+ _abpAntiForgeryOptions = abpAntiForgeryOptions.Value;
+ }
+
+ public virtual string GetAuthCookieNameOrNull()
+ {
+ if (_abpAntiForgeryOptions.AuthCookieSchemaName == null)
+ {
+ return null;
+ }
+
+ return _namedOptionsAccessor.Get(_abpAntiForgeryOptions.AuthCookieSchemaName)?.Cookie?.Name;
+ }
+
+ public virtual string GetAntiForgeryCookieNameOrNull()
+ {
+ return _abpAntiForgeryOptions.TokenCookie.Name;
+ }
+ }
+}
diff --git a/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AbpAntiForgeryManagerAspNetCoreExtensions.cs b/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AbpAntiForgeryManagerAspNetCoreExtensions.cs
index c5c992b364..31ea869b06 100644
--- a/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AbpAntiForgeryManagerAspNetCoreExtensions.cs
+++ b/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AbpAntiForgeryManagerAspNetCoreExtensions.cs
@@ -4,7 +4,11 @@
{
public static void SetCookie(this IAbpAntiForgeryManager manager)
{
- manager.HttpContext.Response.Cookies.Append(manager.Options.TokenCookieName, manager.GenerateToken());
+ manager.HttpContext.Response.Cookies.Append(
+ manager.Options.TokenCookie.Name,
+ manager.GenerateToken(),
+ manager.Options.TokenCookie.Build(manager.HttpContext)
+ );
}
}
-}
\ No newline at end of file
+}
diff --git a/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AbpAntiForgeryOptions.cs b/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AbpAntiForgeryOptions.cs
index 0dc573fd5d..197cab8ac6 100644
--- a/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AbpAntiForgeryOptions.cs
+++ b/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AbpAntiForgeryOptions.cs
@@ -1,23 +1,69 @@
-namespace Volo.Abp.AspNetCore.Mvc.AntiForgery
+using System;
+using System.Collections.Generic;
+using JetBrains.Annotations;
+using Microsoft.AspNetCore.Http;
+
+namespace Volo.Abp.AspNetCore.Mvc.AntiForgery
{
public class AbpAntiForgeryOptions
{
///
- /// Get/sets cookie name to transfer Anti Forgery token between server and client.
- /// Default value: "XSRF-TOKEN".
+ /// Use to set the cookie options to transfer Anti Forgery token between server and client.
+ /// Default name of the cookie: "XSRF-TOKEN".
///
- public string TokenCookieName { get; set; }
+ public CookieBuilder TokenCookie { get; }
///
- /// Get/sets header name to transfer Anti Forgery token from client to the server.
- /// Default value: "X-XSRF-TOKEN".
+ /// Used to find auth cookie when validating Anti Forgery token.
+ /// Default value: "Identity.Application".
///
- public string TokenHeaderName { get; set; }
+ public string AuthCookieSchemaName { get; set; }
+
+ ///
+ /// Default value: true.
+ ///
+ public bool AutoValidate { get; set; } = true;
+
+ ///
+ /// A predicate to filter types to auto-validate.
+ /// Return true to select the type to validate.
+ /// Default: returns true for all given types.
+ ///
+ [NotNull]
+ public Predicate AutoValidateFilter
+ {
+ get => _autoValidateFilter;
+ set => _autoValidateFilter = Check.NotNull(value, nameof(value));
+ }
+ private Predicate _autoValidateFilter;
+
+ ///
+ /// Default methods: "GET", "HEAD", "TRACE", "OPTIONS".
+ ///
+ [NotNull]
+ public HashSet AutoValidateIgnoredHttpMethods
+ {
+ get => _autoValidateIgnoredHttpMethods;
+ set => _autoValidateIgnoredHttpMethods = Check.NotNull(value, nameof(value));
+ }
+ private HashSet _autoValidateIgnoredHttpMethods;
public AbpAntiForgeryOptions()
{
- TokenCookieName = "XSRF-TOKEN";
- TokenHeaderName = "X-XSRF-TOKEN";
+ AutoValidateFilter = type => true;
+
+ TokenCookie = new CookieBuilder
+ {
+ Name = "XSRF-TOKEN",
+ HttpOnly = false,
+ IsEssential = true,
+ SameSite = SameSiteMode.None,
+ Expiration = TimeSpan.FromDays(3650) //10 years!
+ };
+
+ AuthCookieSchemaName = "Identity.Application";
+
+ AutoValidateIgnoredHttpMethods = new HashSet {"GET", "HEAD", "TRACE", "OPTIONS"};
}
}
-}
\ No newline at end of file
+}
diff --git a/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AbpAutoValidateAntiforgeryTokenAttribute.cs b/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AbpAutoValidateAntiforgeryTokenAttribute.cs
new file mode 100644
index 0000000000..346d5e9db4
--- /dev/null
+++ b/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AbpAutoValidateAntiforgeryTokenAttribute.cs
@@ -0,0 +1,37 @@
+using System;
+using Microsoft.AspNetCore.Mvc.Filters;
+using Microsoft.Extensions.DependencyInjection;
+
+namespace Volo.Abp.AspNetCore.Mvc.AntiForgery
+{
+ [AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, AllowMultiple = false, Inherited = true)]
+ public class AbpAutoValidateAntiforgeryTokenAttribute : Attribute, IFilterFactory, IOrderedFilter
+ {
+ ///
+ /// Gets the order value for determining the order of execution of filters. Filters execute in
+ /// ascending numeric value of the property.
+ ///
+ ///
+ ///
+ /// Filters are executed in a sequence determined by an ascending sort of the property.
+ ///
+ ///
+ /// The default Order for this attribute is 1000 because it must run after any filter which does authentication
+ /// or login in order to allow them to behave as expected (ie Unauthenticated or Redirect instead of 400).
+ ///
+ ///
+ /// Look at for more detailed info.
+ ///
+ ///
+ public int Order { get; set; } = 1000;
+
+ ///
+ public bool IsReusable => true;
+
+ ///
+ public IFilterMetadata CreateInstance(IServiceProvider serviceProvider)
+ {
+ return serviceProvider.GetRequiredService();
+ }
+ }
+}
diff --git a/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AbpAutoValidateAntiforgeryTokenAuthorizationFilter.cs b/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AbpAutoValidateAntiforgeryTokenAuthorizationFilter.cs
new file mode 100644
index 0000000000..8affb3aa08
--- /dev/null
+++ b/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AbpAutoValidateAntiforgeryTokenAuthorizationFilter.cs
@@ -0,0 +1,65 @@
+using System;
+using Microsoft.AspNetCore.Antiforgery;
+using Microsoft.AspNetCore.Mvc.Abstractions;
+using Microsoft.AspNetCore.Mvc.Filters;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
+using Volo.Abp.DependencyInjection;
+
+namespace Volo.Abp.AspNetCore.Mvc.AntiForgery
+{
+ public class AbpAutoValidateAntiforgeryTokenAuthorizationFilter : AbpValidateAntiforgeryTokenAuthorizationFilter, ITransientDependency
+ {
+ private readonly AbpAntiForgeryOptions _options;
+
+ public AbpAutoValidateAntiforgeryTokenAuthorizationFilter(
+ IAntiforgery antiforgery,
+ AbpAntiForgeryCookieNameProvider antiForgeryCookieNameProvider,
+ IOptions options,
+ ILogger logger)
+ : base(
+ antiforgery,
+ antiForgeryCookieNameProvider,
+ logger)
+ {
+ _options = options.Value;
+ }
+
+ protected override bool ShouldValidate(AuthorizationFilterContext context)
+ {
+ if (!_options.AutoValidate)
+ {
+ return false;
+ }
+
+ if(context.ActionDescriptor.IsControllerAction())
+ {
+ var controllerType = context.ActionDescriptor
+ .AsControllerActionDescriptor()
+ .ControllerTypeInfo
+ .AsType();
+
+ if (!_options.AutoValidateFilter(controllerType))
+ {
+ return false;
+ }
+ }
+
+ if (IsIgnoredHttpMethod(context))
+ {
+ return false;
+ }
+
+ return base.ShouldValidate(context);
+ }
+
+ protected virtual bool IsIgnoredHttpMethod(AuthorizationFilterContext context)
+ {
+ return context.HttpContext
+ .Request
+ .Method
+ .ToUpperInvariant()
+ .IsIn(_options.AutoValidateIgnoredHttpMethods);
+ }
+ }
+}
diff --git a/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AbpValidateAntiForgeryTokenAttribute.cs b/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AbpValidateAntiForgeryTokenAttribute.cs
new file mode 100644
index 0000000000..853f642b29
--- /dev/null
+++ b/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AbpValidateAntiForgeryTokenAttribute.cs
@@ -0,0 +1,37 @@
+using System;
+using Microsoft.AspNetCore.Mvc.Filters;
+using Microsoft.Extensions.DependencyInjection;
+
+namespace Volo.Abp.AspNetCore.Mvc.AntiForgery
+{
+ [AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, AllowMultiple = false, Inherited = true)]
+ public class AbpValidateAntiForgeryTokenAttribute : Attribute, IFilterFactory, IOrderedFilter
+ {
+ ///
+ /// Gets the order value for determining the order of execution of filters. Filters execute in
+ /// ascending numeric value of the property.
+ ///
+ ///
+ ///
+ /// Filters are executed in an ordering determined by an ascending sort of the property.
+ ///
+ ///
+ /// The default Order for this attribute is 1000 because it must run after any filter which does authentication
+ /// or login in order to allow them to behave as expected (ie Unauthenticated or Redirect instead of 400).
+ ///
+ ///
+ /// Look at for more detailed info.
+ ///
+ ///
+ public int Order { get; set; } = 1000;
+
+ ///
+ public bool IsReusable => true;
+
+ ///
+ public IFilterMetadata CreateInstance(IServiceProvider serviceProvider)
+ {
+ return serviceProvider.GetRequiredService();
+ }
+ }
+}
\ No newline at end of file
diff --git a/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AbpValidateAntiforgeryTokenAuthorizationFilter.cs b/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AbpValidateAntiforgeryTokenAuthorizationFilter.cs
new file mode 100644
index 0000000000..fd0c5e6a01
--- /dev/null
+++ b/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AbpValidateAntiforgeryTokenAuthorizationFilter.cs
@@ -0,0 +1,81 @@
+using System;
+using System.Threading.Tasks;
+using Microsoft.AspNetCore.Antiforgery;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.Filters;
+using Microsoft.AspNetCore.Mvc.ViewFeatures;
+using Microsoft.Extensions.Logging;
+using Volo.Abp.DependencyInjection;
+
+namespace Volo.Abp.AspNetCore.Mvc.AntiForgery
+{
+ public class AbpValidateAntiforgeryTokenAuthorizationFilter : IAsyncAuthorizationFilter, IAntiforgeryPolicy, ITransientDependency
+ {
+ private IAntiforgery _antiforgery;
+ private readonly AbpAntiForgeryCookieNameProvider _antiForgeryCookieNameProvider;
+ private readonly ILogger _logger;
+
+ public AbpValidateAntiforgeryTokenAuthorizationFilter(
+ IAntiforgery antiforgery,
+ AbpAntiForgeryCookieNameProvider antiForgeryCookieNameProvider,
+ ILogger logger)
+ {
+ _antiforgery = antiforgery;
+ _logger = logger;
+ _antiForgeryCookieNameProvider = antiForgeryCookieNameProvider;
+ }
+
+ public async Task OnAuthorizationAsync(AuthorizationFilterContext context)
+ {
+ if (context == null)
+ {
+ throw new ArgumentNullException(nameof(context));
+ }
+
+ if (!context.IsEffectivePolicy(this))
+ {
+ _logger.LogInformation("Skipping the execution of current filter as its not the most effective filter implementing the policy " + typeof(IAntiforgeryPolicy));
+ return;
+ }
+
+ if (ShouldValidate(context))
+ {
+ try
+ {
+ await _antiforgery.ValidateRequestAsync(context.HttpContext);
+ }
+ catch (AntiforgeryValidationException exception)
+ {
+ _logger.LogError(exception.Message, exception);
+ context.Result = new AntiforgeryValidationFailedResult();
+ }
+ }
+ }
+
+ protected virtual bool ShouldValidate(AuthorizationFilterContext context)
+ {
+ var authCookieName = _antiForgeryCookieNameProvider.GetAuthCookieNameOrNull();
+
+ //Always perform antiforgery validation when request contains authentication cookie
+ if (authCookieName != null &&
+ context.HttpContext.Request.Cookies.ContainsKey(authCookieName))
+ {
+ return true;
+ }
+
+ var antiForgeryCookieName = _antiForgeryCookieNameProvider.GetAntiForgeryCookieNameOrNull();
+
+ //No need to validate if antiforgery cookie is not sent.
+ //That means the request is sent from a non-browser client.
+ //See https://github.com/aspnet/Antiforgery/issues/115
+ if (antiForgeryCookieName != null &&
+ !context.HttpContext.Request.Cookies.ContainsKey(antiForgeryCookieName))
+ {
+ return false;
+ }
+
+ // Anything else requires a token.
+ return true;
+ }
+ }
+}
diff --git a/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AspNetCoreAbpAntiForgeryManager.cs b/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AspNetCoreAbpAntiForgeryManager.cs
index f016c36671..ff1ec26d1c 100644
--- a/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AspNetCoreAbpAntiForgeryManager.cs
+++ b/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/AntiForgery/AspNetCoreAbpAntiForgeryManager.cs
@@ -26,7 +26,11 @@ namespace Volo.Abp.AspNetCore.Mvc.AntiForgery
public void SetCookie()
{
- HttpContext.Response.Cookies.Append(Options.TokenCookieName, GenerateToken());
+ HttpContext.Response.Cookies.Append(
+ Options.TokenCookie.Name,
+ GenerateToken(),
+ Options.TokenCookie.Build(HttpContext)
+ );
}
public string GenerateToken()
@@ -34,4 +38,4 @@ namespace Volo.Abp.AspNetCore.Mvc.AntiForgery
return _antiforgery.GetAndStoreTokens(_httpContextAccessor.HttpContext).RequestToken;
}
}
-}
\ No newline at end of file
+}
diff --git a/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/ApplicationConfigurations/AbpApplicationConfigurationController.cs b/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/ApplicationConfigurations/AbpApplicationConfigurationController.cs
index 67c373585e..89282110b9 100644
--- a/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/ApplicationConfigurations/AbpApplicationConfigurationController.cs
+++ b/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/ApplicationConfigurations/AbpApplicationConfigurationController.cs
@@ -1,5 +1,6 @@
using System.Threading.Tasks;
using Microsoft.AspNetCore.Mvc;
+using Volo.Abp.AspNetCore.Mvc.AntiForgery;
namespace Volo.Abp.AspNetCore.Mvc.ApplicationConfigurations
{
@@ -9,17 +10,21 @@ namespace Volo.Abp.AspNetCore.Mvc.ApplicationConfigurations
public class AbpApplicationConfigurationController : AbpController, IAbpApplicationConfigurationAppService
{
private readonly IAbpApplicationConfigurationAppService _applicationConfigurationAppService;
+ private readonly IAbpAntiForgeryManager _antiForgeryManager;
public AbpApplicationConfigurationController(
- IAbpApplicationConfigurationAppService applicationConfigurationAppService)
+ IAbpApplicationConfigurationAppService applicationConfigurationAppService,
+ IAbpAntiForgeryManager antiForgeryManager)
{
_applicationConfigurationAppService = applicationConfigurationAppService;
+ _antiForgeryManager = antiForgeryManager;
}
[HttpGet]
public async Task GetAsync()
{
+ _antiForgeryManager.SetCookie();
return await _applicationConfigurationAppService.GetAsync();
}
}
-}
\ No newline at end of file
+}
diff --git a/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/ApplicationConfigurations/AbpApplicationConfigurationScriptController.cs b/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/ApplicationConfigurations/AbpApplicationConfigurationScriptController.cs
index d4ce99dc12..7a773d92eb 100644
--- a/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/ApplicationConfigurations/AbpApplicationConfigurationScriptController.cs
+++ b/framework/src/Volo.Abp.AspNetCore.Mvc/Volo/Abp/AspNetCore/Mvc/ApplicationConfigurations/AbpApplicationConfigurationScriptController.cs
@@ -2,6 +2,7 @@
using System.Threading.Tasks;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Extensions.Options;
+using Volo.Abp.AspNetCore.Mvc.AntiForgery;
using Volo.Abp.Auditing;
using Volo.Abp.Http;
using Volo.Abp.Json;
@@ -20,17 +21,20 @@ namespace Volo.Abp.AspNetCore.Mvc.ApplicationConfigurations
private readonly IJsonSerializer _jsonSerializer;
private readonly AbpAspNetCoreMvcOptions _options;
private readonly IJavascriptMinifier _javascriptMinifier;
+ private readonly IAbpAntiForgeryManager _antiForgeryManager;
public AbpApplicationConfigurationScriptController(
IAbpApplicationConfigurationAppService configurationAppService,
IJsonSerializer jsonSerializer,
IOptions options,
- IJavascriptMinifier javascriptMinifier)
+ IJavascriptMinifier javascriptMinifier,
+ IAbpAntiForgeryManager antiForgeryManager)
{
_configurationAppService = configurationAppService;
_jsonSerializer = jsonSerializer;
_options = options.Value;
_javascriptMinifier = javascriptMinifier;
+ _antiForgeryManager = antiForgeryManager;
}
[HttpGet]
@@ -39,6 +43,8 @@ namespace Volo.Abp.AspNetCore.Mvc.ApplicationConfigurations
{
var script = CreateAbpExtendScript(await _configurationAppService.GetAsync());
+ _antiForgeryManager.SetCookie();
+
return Content(
_options.MinifyGeneratedScript == true
? _javascriptMinifier.Minify(script)
diff --git a/framework/src/Volo.Abp.AspNetCore/Microsoft/AspNetCore/RequestLocalization/DefaultAbpRequestLocalizationOptionsProvider.cs b/framework/src/Volo.Abp.AspNetCore/Microsoft/AspNetCore/RequestLocalization/DefaultAbpRequestLocalizationOptionsProvider.cs
index 263d0532d0..001fc6a02d 100644
--- a/framework/src/Volo.Abp.AspNetCore/Microsoft/AspNetCore/RequestLocalization/DefaultAbpRequestLocalizationOptionsProvider.cs
+++ b/framework/src/Volo.Abp.AspNetCore/Microsoft/AspNetCore/RequestLocalization/DefaultAbpRequestLocalizationOptionsProvider.cs
@@ -5,7 +5,6 @@ using System.Linq;
using System.Threading;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Builder;
-using Microsoft.AspNetCore.Identity;
using Microsoft.AspNetCore.Localization;
using Microsoft.Extensions.DependencyInjection;
using Nito.AsyncEx;
diff --git a/framework/src/Volo.Abp.Core/System/AbpObjectExtensions.cs b/framework/src/Volo.Abp.Core/System/AbpObjectExtensions.cs
index d1067a383f..958398e0c5 100644
--- a/framework/src/Volo.Abp.Core/System/AbpObjectExtensions.cs
+++ b/framework/src/Volo.Abp.Core/System/AbpObjectExtensions.cs
@@ -1,4 +1,5 @@
-using System.ComponentModel;
+using System.Collections.Generic;
+using System.ComponentModel;
using System.Globalization;
using System.Linq;
@@ -49,6 +50,17 @@ namespace System
return list.Contains(item);
}
+ ///
+ /// Check if an item is in the given enumerable.
+ ///
+ /// Item to check
+ /// Items
+ /// Type of the items
+ public static bool IsIn(this T item, IEnumerable items)
+ {
+ return items.Contains(item);
+ }
+
///
/// Can be used to conditionally perform a function
/// on an object and return the modified or the original object.
diff --git a/framework/src/Volo.Abp.Http.Client.IdentityModel.WebAssembly/Volo/Abp/Http/Client/IdentityModel/WebAssembly/AccessTokenProviderIdentityModelRemoteServiceHttpClientAuthenticator.cs b/framework/src/Volo.Abp.Http.Client.IdentityModel.WebAssembly/Volo/Abp/Http/Client/IdentityModel/WebAssembly/AccessTokenProviderIdentityModelRemoteServiceHttpClientAuthenticator.cs
index c86fc095c7..0e0b659ef1 100644
--- a/framework/src/Volo.Abp.Http.Client.IdentityModel.WebAssembly/Volo/Abp/Http/Client/IdentityModel/WebAssembly/AccessTokenProviderIdentityModelRemoteServiceHttpClientAuthenticator.cs
+++ b/framework/src/Volo.Abp.Http.Client.IdentityModel.WebAssembly/Volo/Abp/Http/Client/IdentityModel/WebAssembly/AccessTokenProviderIdentityModelRemoteServiceHttpClientAuthenticator.cs
@@ -20,7 +20,7 @@ namespace Volo.Abp.Http.Client.IdentityModel.WebAssembly
AccessTokenProvider = accessTokenProvider;
}
- public override async Task Authenticate(RemoteServiceHttpClientAuthenticateContext context)
+ public async override Task Authenticate(RemoteServiceHttpClientAuthenticateContext context)
{
if (context.RemoteService.GetUseCurrentAccessToken() != false)
{
diff --git a/framework/test/Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.Demo/wwwroot/libs/abp/core/abp.js b/framework/test/Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.Demo/wwwroot/libs/abp/core/abp.js
index 20bd92147a..72af4bd106 100644
--- a/framework/test/Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.Demo/wwwroot/libs/abp/core/abp.js
+++ b/framework/test/Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.Demo/wwwroot/libs/abp/core/abp.js
@@ -689,7 +689,7 @@ var abp = abp || {};
abp.security.antiForgery = abp.security.antiForgery || {};
abp.security.antiForgery.tokenCookieName = 'XSRF-TOKEN';
- abp.security.antiForgery.tokenHeaderName = 'X-XSRF-TOKEN';
+ abp.security.antiForgery.tokenHeaderName = 'RequestVerificationToken';
abp.security.antiForgery.getToken = function () {
return abp.utils.getCookieValue(abp.security.antiForgery.tokenCookieName);
diff --git a/framework/test/Volo.Abp.AspNetCore.Mvc.UI.Theme.Basic.Demo/wwwroot/libs/abp/core/abp.js b/framework/test/Volo.Abp.AspNetCore.Mvc.UI.Theme.Basic.Demo/wwwroot/libs/abp/core/abp.js
index 20bd92147a..72af4bd106 100644
--- a/framework/test/Volo.Abp.AspNetCore.Mvc.UI.Theme.Basic.Demo/wwwroot/libs/abp/core/abp.js
+++ b/framework/test/Volo.Abp.AspNetCore.Mvc.UI.Theme.Basic.Demo/wwwroot/libs/abp/core/abp.js
@@ -689,7 +689,7 @@ var abp = abp || {};
abp.security.antiForgery = abp.security.antiForgery || {};
abp.security.antiForgery.tokenCookieName = 'XSRF-TOKEN';
- abp.security.antiForgery.tokenHeaderName = 'X-XSRF-TOKEN';
+ abp.security.antiForgery.tokenHeaderName = 'RequestVerificationToken';
abp.security.antiForgery.getToken = function () {
return abp.utils.getCookieValue(abp.security.antiForgery.tokenCookieName);
diff --git a/modules/blogging/app/Volo.BloggingTestApp/wwwroot/libs/abp/core/abp.js b/modules/blogging/app/Volo.BloggingTestApp/wwwroot/libs/abp/core/abp.js
index 20bd92147a..72af4bd106 100644
--- a/modules/blogging/app/Volo.BloggingTestApp/wwwroot/libs/abp/core/abp.js
+++ b/modules/blogging/app/Volo.BloggingTestApp/wwwroot/libs/abp/core/abp.js
@@ -689,7 +689,7 @@ var abp = abp || {};
abp.security.antiForgery = abp.security.antiForgery || {};
abp.security.antiForgery.tokenCookieName = 'XSRF-TOKEN';
- abp.security.antiForgery.tokenHeaderName = 'X-XSRF-TOKEN';
+ abp.security.antiForgery.tokenHeaderName = 'RequestVerificationToken';
abp.security.antiForgery.getToken = function () {
return abp.utils.getCookieValue(abp.security.antiForgery.tokenCookieName);
diff --git a/modules/client-simulation/demo/Volo.ClientSimulation.Demo/wwwroot/libs/abp/core/abp.js b/modules/client-simulation/demo/Volo.ClientSimulation.Demo/wwwroot/libs/abp/core/abp.js
index 20bd92147a..72af4bd106 100644
--- a/modules/client-simulation/demo/Volo.ClientSimulation.Demo/wwwroot/libs/abp/core/abp.js
+++ b/modules/client-simulation/demo/Volo.ClientSimulation.Demo/wwwroot/libs/abp/core/abp.js
@@ -689,7 +689,7 @@ var abp = abp || {};
abp.security.antiForgery = abp.security.antiForgery || {};
abp.security.antiForgery.tokenCookieName = 'XSRF-TOKEN';
- abp.security.antiForgery.tokenHeaderName = 'X-XSRF-TOKEN';
+ abp.security.antiForgery.tokenHeaderName = 'RequestVerificationToken';
abp.security.antiForgery.getToken = function () {
return abp.utils.getCookieValue(abp.security.antiForgery.tokenCookieName);
diff --git a/modules/cms-kit/host/Volo.CmsKit.IdentityServer/wwwroot/libs/abp/core/abp.js b/modules/cms-kit/host/Volo.CmsKit.IdentityServer/wwwroot/libs/abp/core/abp.js
index 20bd92147a..72af4bd106 100644
--- a/modules/cms-kit/host/Volo.CmsKit.IdentityServer/wwwroot/libs/abp/core/abp.js
+++ b/modules/cms-kit/host/Volo.CmsKit.IdentityServer/wwwroot/libs/abp/core/abp.js
@@ -689,7 +689,7 @@ var abp = abp || {};
abp.security.antiForgery = abp.security.antiForgery || {};
abp.security.antiForgery.tokenCookieName = 'XSRF-TOKEN';
- abp.security.antiForgery.tokenHeaderName = 'X-XSRF-TOKEN';
+ abp.security.antiForgery.tokenHeaderName = 'RequestVerificationToken';
abp.security.antiForgery.getToken = function () {
return abp.utils.getCookieValue(abp.security.antiForgery.tokenCookieName);
diff --git a/modules/cms-kit/host/Volo.CmsKit.Web.Host/wwwroot/libs/abp/core/abp.js b/modules/cms-kit/host/Volo.CmsKit.Web.Host/wwwroot/libs/abp/core/abp.js
index 20bd92147a..72af4bd106 100644
--- a/modules/cms-kit/host/Volo.CmsKit.Web.Host/wwwroot/libs/abp/core/abp.js
+++ b/modules/cms-kit/host/Volo.CmsKit.Web.Host/wwwroot/libs/abp/core/abp.js
@@ -689,7 +689,7 @@ var abp = abp || {};
abp.security.antiForgery = abp.security.antiForgery || {};
abp.security.antiForgery.tokenCookieName = 'XSRF-TOKEN';
- abp.security.antiForgery.tokenHeaderName = 'X-XSRF-TOKEN';
+ abp.security.antiForgery.tokenHeaderName = 'RequestVerificationToken';
abp.security.antiForgery.getToken = function () {
return abp.utils.getCookieValue(abp.security.antiForgery.tokenCookieName);
diff --git a/modules/cms-kit/host/Volo.CmsKit.Web.Unified/wwwroot/libs/abp/core/abp.js b/modules/cms-kit/host/Volo.CmsKit.Web.Unified/wwwroot/libs/abp/core/abp.js
index 20bd92147a..72af4bd106 100644
--- a/modules/cms-kit/host/Volo.CmsKit.Web.Unified/wwwroot/libs/abp/core/abp.js
+++ b/modules/cms-kit/host/Volo.CmsKit.Web.Unified/wwwroot/libs/abp/core/abp.js
@@ -689,7 +689,7 @@ var abp = abp || {};
abp.security.antiForgery = abp.security.antiForgery || {};
abp.security.antiForgery.tokenCookieName = 'XSRF-TOKEN';
- abp.security.antiForgery.tokenHeaderName = 'X-XSRF-TOKEN';
+ abp.security.antiForgery.tokenHeaderName = 'RequestVerificationToken';
abp.security.antiForgery.getToken = function () {
return abp.utils.getCookieValue(abp.security.antiForgery.tokenCookieName);
diff --git a/modules/docs/app/VoloDocs.Web/wwwroot/libs/abp/core/abp.js b/modules/docs/app/VoloDocs.Web/wwwroot/libs/abp/core/abp.js
index 20bd92147a..72af4bd106 100644
--- a/modules/docs/app/VoloDocs.Web/wwwroot/libs/abp/core/abp.js
+++ b/modules/docs/app/VoloDocs.Web/wwwroot/libs/abp/core/abp.js
@@ -689,7 +689,7 @@ var abp = abp || {};
abp.security.antiForgery = abp.security.antiForgery || {};
abp.security.antiForgery.tokenCookieName = 'XSRF-TOKEN';
- abp.security.antiForgery.tokenHeaderName = 'X-XSRF-TOKEN';
+ abp.security.antiForgery.tokenHeaderName = 'RequestVerificationToken';
abp.security.antiForgery.getToken = function () {
return abp.utils.getCookieValue(abp.security.antiForgery.tokenCookieName);
diff --git a/modules/docs/src/Volo.Docs.Web/Pages/Documents/Project/Index.cshtml b/modules/docs/src/Volo.Docs.Web/Pages/Documents/Project/Index.cshtml
index afbb5fcf5b..a7897eddfe 100644
--- a/modules/docs/src/Volo.Docs.Web/Pages/Documents/Project/Index.cshtml
+++ b/modules/docs/src/Volo.Docs.Web/Pages/Documents/Project/Index.cshtml
@@ -305,7 +305,10 @@