AJAX call "Antiforgery token not present"

[xorinzor]

Using ABP 7.2 with MVC in a layered application.

I'm following this code from the BookStore example for deleting entities: https://github.com/abpframework/abp-samples/blob/master/BookStore-Mvc-EfCore/src/Acme.BookStore.Web/Pages/Books/Index.js#LL34C55-L34C55

But when I add this to my own project I get a 400 error response upon deleting an entity, with the server logging

The required antiforgery header value "RequestVerificationToken" is not present.

I tried fixing it by adding this:

(function (send) {
    XMLHttpRequest.prototype.send = function (data) {
        this.setRequestHeader(abp.security.antiForgery.tokenHeaderName, abp.security.antiForgery.getToken());
        return send.call(this, data);
    };
})(XMLHttpRequest.prototype.send);

But that still results in an 400 with the error:

The antiforgery token could not be decrypted.

How can I fix this?

[realLiangshiwei]

Do you also have this problem if you use the bookstore example project?

[xorinzor]

Probably not, I was using it as an example what code I've added to my project.

How can I get that delete function to pass along a antiforgerytoken? Tried a couple of things but they always result in 1 of the 2 errors of my main post

[realLiangshiwei]

https://docs.abp.io/en/abp/latest/CSRF-Anti-Forgery
You can check the document.

And abp will add the csrf token to the request header automatically .https://github.com/abpframework/abp/blob/dev/npm/packs/jquery/src/abp.jquery.js#L254-L268
You should check your project.

[xorinzor]

abp.security.antiForgery.getToken() is returning null no matter what I do.

The documentation (which I already read before posting this question) does not explain anything other then stating it's enabled by default.

"Check your project" does not help if I have no idea what I'm looking for. Everything I compare to the BookStore example is the same, and none of the documentation is stating that I should be adding anything, or indicating that I forgot something.

For some reason the XSRF-TOKEN cookie is not being created, resulting in the abp.security.antiForgery.getToken() method returning null

[xorinzor]

The cookie is being blocked apparently due to the way ABP tries to configure the cookie.

The same error also shows up in the server log:

The cookie 'XSRF-TOKEN' has set 'SameSite=None' and must also set 'Secure'.

[xorinzor]

Chrome was blocking the cookie.

I had to add this to my WebModule:

Configure<AbpAntiForgeryOptions>(options => {
    options.TokenCookie.SameSite = SameSiteMode.Strict;
});