Services
Technology Web App Development Mobile App Development Windows App Development Database Development UI/UX Development Cloud Development SEO Digital Marketing Guest Posting Content Writing Artificial Intelligence Data Science ERP Development CRM Development CMS Development LMS Development Business Listing Blockchain Technology Startup Promotion AI Tools Integration
Products
Data Converter Cleaner TUC - Unit Converter Import Export Survey Manager Tweet Controller
Developer
Article Blog Forum Interview Beginner News Startup Quiz
Users
Career
Apply Job Internship
Pricing
Login Sign Up Get a Quote

interview

Home Interviews How to call @html.AntiForgeryToken in ASP.NET Web API – MindStick
Ask Question

1 Answers

ICSM Computer
ICSM Computer 10 Jun 2025
Report Abuse

In ASP.NET Web API (not MVC), @Html.AntiForgeryToken() does not apply directly because Web API does not use Razor views or MVC forms by default.

However, you can integrate anti-forgery protection into Web API by manually validating anti-forgery tokens for APIs that are accessed via AJAX (e.g., from MVC views or SPAs).

Goal: Use Anti-Forgery Token in Web API

Step 1: Generate the Token in MVC View

If your front-end uses Razor (MVC view), generate the anti-forgery token using:

@Html.AntiForgeryToken()

This emits two things:

  1. A hidden form field: __RequestVerificationToken
  2. A cookie: __RequestVerificationToken

Step 2: Send Token with AJAX Request

In JavaScript, extract the token from the cookie or form and send it as a header:

// Get the anti-forgery token from the form or cookie
var token = $('input[name="__RequestVerificationToken"]').val();

$.ajax({
    url: '/api/account/secure',
    type: 'POST',
    headers: {
        'RequestVerificationToken': token
    },
    data: { /* your payload */ },
    success: function (response) {
        // handle success
    }
});

Step 3: Validate the Token in Web API

Create a custom filter attribute to validate the anti-forgery token:

using System.Web;
using System.Web.Http.Controllers;
using System.Web.Http.Filters;
using System.Web.Helpers;

public class ValidateAntiForgeryTokenAttribute : AuthorizationFilterAttribute
{
    public override void OnAuthorization(HttpActionContext actionContext)
    {
        var headers = actionContext.Request.Headers;

        if (headers.Contains("RequestVerificationToken"))
        {
            try
            {
                var cookieToken = "";
                var formToken = headers.GetValues("RequestVerificationToken").FirstOrDefault();

                if (HttpContext.Current.Request.Cookies["__RequestVerificationToken"] != null)
                {
                    cookieToken = HttpContext.Current.Request.Cookies["__RequestVerificationToken"].Value;
                }

                AntiForgery.Validate(cookieToken, formToken);
            }
            catch (HttpAntiForgeryException ex)
            {
                throw new HttpResponseException(System.Net.HttpStatusCode.Forbidden);
            }
        }
        else
        {
            throw new HttpResponseException(System.Net.HttpStatusCode.Forbidden);
        }
    }
}

Step 4: Apply the Attribute to API Methods

[ValidateAntiForgeryToken]
public class AccountController : ApiController
{
    [HttpPost]
    public IHttpActionResult Secure(SomeModel model)
    {
        // Only reached if anti-forgery token is valid
        return Ok("Request valid");
    }
}

Summary

Component Purpose
@Html.AntiForgeryToken() Renders hidden input and cookie
Custom filter Validates token on Web API
JavaScript header Sends token with AJAX
AntiForgery.Validate(cookie, token) Validates tokens on server
advertising
Markdown for AI

A clean, structured version of this page for AI assistants and LLMs.

Open .md