Calling Minimal API with IFormFile gets "Invalid anti-forgery token"

[marinasundstrom]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

This is .NET 8 Preview 7.

I have a Minimal API endpoint that takes a IFormFile as an argument. When the endpoint is called ASP.NET core complains with:

Microsoft.AspNetCore.Http.BadHttpRequestException: Invalid anti-forgery token found when reading parameter "IFormFile file" from the request body as form.

If I call the endpoint from Swagger, I get the following exception in the console:

fail: Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware[1]
      An unhandled exception has occurred while executing the request.
      Microsoft.AspNetCore.Http.BadHttpRequestException: Invalid anti-forgery token found when reading parameter "IFormFile file" from the request body as form.
       ---> Microsoft.AspNetCore.Antiforgery.AntiforgeryValidationException: The required antiforgery cookie ".AspNetCore.Antiforgery.C6Qawqa1gJE" is not present.
         at Microsoft.AspNetCore.Antiforgery.DefaultAntiforgery.ValidateRequestAsync(HttpContext httpContext)
         at Microsoft.AspNetCore.Antiforgery.Internal.AntiforgeryMiddleware.InvokeAwaited(HttpContext context)
         --- End of inner exception stack trace ---
         at Microsoft.AspNetCore.Http.RequestDelegateFactory.Log.InvalidAntiforgeryToken(HttpContext httpContext, String parameterTypeName, String parameterName, Exception exception, Boolean shouldThrow)

Expected Behavior

The API endpoint should just work.

Steps To Reproduce

The code for the endpoint:

    private static async Task<Results<Ok, NotFound>> UploadProductImage(string id, IFormFile file, ... CancellationToken cancellationToken)
    {
        // Omitted 

        return TypedResults.Ok();
    }

        app.MapPost("/api/products/{id}/image", UploadProductImage)
            .WithName($"Products_{nameof(UploadProductImage)}")
            .WithTags("Products")
            .WithOpenApi();

Exceptions (if any)

No response

.NET Version

8.0.100-preview.7.23376.3

Anything else?

No response

[martincostello]

If your endpoint is safe to not apply antiforgery protection to, you can disable this by adding DisableAntiforgery() to it:

app.MapPost("/api/products/{id}/image", UploadProductImage)
   .WithName($"Products_{nameof(UploadProductImage)}")
   .WithTags("Products")
   .WithOpenApi()
   .DisableAntiforgery();

[marinasundstrom]

@martincostello Thanks! I was looking for that. It was a major blocker.

I get that anti-forgery protection has been implemented and turned on because of forms in Blazor SSR.

[captainsafia]

Thanks for filing this issue, @marinasundstrom! It looks like the new anti-forgery feature in preview.7 worked for you. We'll have docs on this soon but for now @martincostello's on using the extension method to disable the check is correct here.

[ghost]

This issue has been resolved and has not had any activity for 1 day. It will be closed for housekeeping purposes.

See our Issue Management Policies for more information.