Announcing Separate Antiforgery Package in Beta-6

[rynowak]

In response to your feedback, we've moved the antiforgery system into its own package: Microsoft.AspNet.Antiforgery. There's now nothing tying this system to MVC, and it has a very lean dependency footprint.

You can find the repository here: https://github.com/aspnet/antiforgery Please use the Antiforgery repo for any issues or suggestions that you have. We'd especially like to know if we've covered all the necessary points of extensibility for using antiforgery outside of MVC.

Beta-6 builds of MVC have now been updated to use the separate package: https://github.com/aspnet/Mvc/commit/2f554c4b290ee7845ffaf8bf8e5faf4336398950

Breaking Changes

The new namespace for antiforgery is Microsoft.AspNet.Antiforgery. The Antiforgery facade class now implements IAntiforgery, which is the primary service needed to interact with the antiforgery system. Several APIs on this interface/class have been renamed for clarity.

If you're using MVC, you don't need to do anything extra to add antiforgery services.

If you're not using MVC and want to use antiforgery, there's a new API for adding the required services.

new (Startup.cs)

services.AddAntiforgery();

As antiforgery is now a stand-alone package, configuring options has changed.

old (Startup.cs)

services.ConfigureMvc(options =>
{
    options.AntiForgeryOptions.CookieName = "My-Cookie";
});

new (Startup.cs)

services.ConfigureAntiforgery(options =>
{
    options.CookieName = "My-Cookie";
});

The MVC form TagHelper has add the asp-anti-forgery attribute renamed to asp-antiforgery.

[jensenkd]

fantastic! this is getting good my friends.

[khellang]

Nice! :+1:

[NotMyself]

Sweet! :shipit: :rocket: :package:

[sheryever]

:+1:

[calebjenkins]

Even better Lego pieces.. keep up the great work!

[wulixu]

Nice!