为什么默认情况下每个表单中不包含 AntiForgeryToken？
我感兴趣为什么不是 AntiForgeryToken 默认情况下包含在每个 ASP.NET MVC 表单中？ 似乎总是包含它的优点超过了可能的缺点。 如果需要，可以禁用此行为，例如 Web 表单 HttpRequestValidationException。
I am interested why isn't AntiForgeryToken included in every ASP.NET MVC form by default? It seems the pluses of always including it outweigh the possible disadvantages. And this behaviour could be disabled in case of need like for Web Forms HttpRequestValidationException.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
我认为是因为您不想将其放在具有
GET方法的表单上。I think because you wouldn't want to have it on forms with
GETmethod.AntiForgeryToken 在 2 月份才从“MVC Futures”转移到“MVC Core”——因此很可能这个时机阻止了它成为内置装置。
另一个可能的原因是，开发MVC框架的团队确实把所有的权力都放在了开发人员的手中。 您可以使用其他东西来代替 AntiForgeryToken，就像您可以选择使用不同的测试框架、数据框架等一样。当您回顾 MS 的历史时，这是一种新方法，他们会迫使您使用他们提供的内容。
The AntiForgeryToken was only moved from "MVC Futures" to "MVC Core" in February - so it's likely that the timing prevented it from being made a built in fixture.
The other possible reason is that the team that developed the MVC framework have really put all the power in the hands of the developers. You could use something else instead of the AntiForgeryToken in the same way you can choose to use a different testing framework, data framework etc. It's a new approach when you look at MS historically, where they would pen you into using what they supplied.