c# - Processing AntiForgeryToken send with Ajax -

hello i'm following this tutorial:

and i'm trying send ajax request include antiforgerytoken. here ajax request:

$(document).ready(function () {     @functions{         public string tokenheadervalue()         {             string cookietoken, formtoken;             antiforgery.gettokens(null, out cookietoken, out formtoken);             return cookietoken + ":" + formtoken;                         }     }     $('.z').on('click', function (event) {         event.preventdefault();         $.ajax({             url: "/deviceusage/return",             type: "post",             contenttype: "application/json; charset=utf-8",             datatype: 'html',             headers: {                 'requestverificationtoken': '@tokenheadervalue()'             },             data: json.stringify({ dev: { deviceinstanceid: $('#deviceinstanceid').val(), userid: "1", storageid: $('#storageid').val() } }),             error: function (data) {                 alert("wystąpił nieokreślony błąd " + data);             },             success: function (data) {                 $('.modal-body').html(data);             }         })     }) }); 

here controller:

[httppost]     [validateantiforgerytoken]     public actionresult return(deviceusage dev)     {         if(dev.storageid==3)         {             modelstate.addmodelerror("", "nie można oddać na własne biurko");             viewbag.storageid = new selectlist(unitofwork.storagerepository.get(), "id", "name", dev.storageid);             return partialview(dev);         }         dev.userid = 1;         unitofwork.deviceusagerepository.update(dev);         unitofwork.save();         return redirecttoaction("mydevices");     } 

but in tutorial show function like:

void validaterequestheader(httprequestmessage request) { string cookietoken = ""; string formtoken = "";  ienumerable<string> tokenheaders; if (request.headers.trygetvalues("requestverificationtoken", out tokenheaders)) {     string[] tokens = tokenheaders.first().split(':');     if (tokens.length == 2)     {         cookietoken = tokens[0].trim();         formtoken = tokens[1].trim();     } } antiforgery.validate(cookietoken, formtoken); } 

but have no idea put code in controller , how call function. can explain me how use above code?

what showing in anti-csrf , ajax section of tutorial non-standard token validation method. in example not use [validateantiforgerytoken], rather run validation manually. firstly inject additional header in ajax call:

        headers: {             'requestverificationtoken': '@tokenheadervalue()'         }, 

and read , validate token header in action:

[httppost] public actionresult return(deviceusage dev) {     validaterequestheader(request);     //process action } void validaterequestheader(httprequestbase request) {     string cookietoken = "";     string formtoken = "";      if (request.headers["requestverificationtoken"] != null)     {         string[] tokens = request.headers["requestverificationtoken"].split(':');         if (tokens.length == 2)         {             cookietoken = tokens[0].trim();             formtoken = tokens[1].trim();         }     }     antiforgery.validate(cookietoken, formtoken); } 

notice validaterequestheader() reads header set earlier jquery call. also, i've amended method accept httprequestbase.

tip: avoid adding validaterequestheader() every controller responds ajax calls, add base controller if have any, , derive controllers base. or better create own [validateantiforgeryajaxtoken] attribute.