#2315 change antiForgeryToken storage and call to improve page loading

DavidBlaa · DavidBlaa · commit 1a15d18ef795 · 2025-12-16T16:09:33.000+01:00
diff --git a/BExIS++.sln b/BExIS++.sln
@@ -1606,8 +1606,8 @@ Global
 		{37402CAB-EB81-4D08-8791-8653949C0FEB} = {02EA681E-C7D8-13C7-8484-4AC65E1B71E8}
 	EndGlobalSection
 	GlobalSection(ExtensibilityGlobals) = postSolution
-		SolutionGuid = {9B6E4921-8EBA-487D-A098-3E473A0EAC64}
 		EnterpriseLibraryConfigurationToolBinariesPath = packages\Unity.2.1.505.0\lib\NET35;packages\Unity.2.1.505.2\lib\NET35
+		SolutionGuid = {9B6E4921-8EBA-487D-A098-3E473A0EAC64}
 	EndGlobalSection
 	GlobalSection(SubversionScc) = preSolution
 		Svn-Managed = True
diff --git a/Components/App/BExIS.App.Bootstrap/Attributes/BExISAuthorizeAttribute.cs b/Components/App/BExIS.App.Bootstrap/Attributes/BExISAuthorizeAttribute.cs
@@ -50,9 +50,6 @@ public override void OnAuthorization(AuthorizationContext filterContext)
                                 if (!featurePermissionManager.HasAccessAsync(user.Id, feature.Id).Result)
                                 {
                                     filterContext.SetResponse(HttpStatusCode.Forbidden);
-
-                                    
-
                                 }
 
                                 // update jwt cookie
diff --git a/Console/BExIS.Web.Shell.Svelte/package-lock.json b/Console/BExIS.Web.Shell.Svelte/package-lock.json
diff --git a/Console/BExIS.Web.Shell.Svelte/package.json b/Console/BExIS.Web.Shell.Svelte/package.json
@@ -52,7 +52,7 @@
 	},
 	"type": "module",
 	"dependencies": {
-		"@bexis2/bexis2-core-ui": "0.4.60",
+		"@bexis2/bexis2-core-ui": "0.4.63",
 		"@sveltejs/adapter-static": "3.0.2",
 		"buffer": "6.0.3",
 		"gray-matter": "4.0.3",
diff --git a/Console/BExIS.Web.Shell/Areas/DCM/BExIS.Modules.Dcm.UI.Svelte/package-lock.json b/Console/BExIS.Web.Shell/Areas/DCM/BExIS.Modules.Dcm.UI.Svelte/package-lock.json
diff --git a/Console/BExIS.Web.Shell/Areas/DCM/BExIS.Modules.Dcm.UI.Svelte/package.json b/Console/BExIS.Web.Shell/Areas/DCM/BExIS.Modules.Dcm.UI.Svelte/package.json
@@ -50,7 +50,7 @@
 	},
 	"type": "module",
 	"dependencies": {
-		"@bexis2/bexis2-core-ui": "0.4.60",
+		"@bexis2/bexis2-core-ui": "0.4.63",
 		"@bexis2/bexis2-rpm-ui": "0.2.15",
 		"@floating-ui/dom": "1.6.8",
 		"@fortawesome/free-solid-svg-icons": "6.6.0",
diff --git a/Console/BExIS.Web.Shell/Areas/DDM/BExIS.Modules.Ddm.UI.Svelte/package-lock.json b/Console/BExIS.Web.Shell/Areas/DDM/BExIS.Modules.Ddm.UI.Svelte/package-lock.json
diff --git a/Console/BExIS.Web.Shell/Areas/DDM/BExIS.Modules.Ddm.UI.Svelte/package.json b/Console/BExIS.Web.Shell/Areas/DDM/BExIS.Modules.Ddm.UI.Svelte/package.json
@@ -50,7 +50,7 @@
 	},
 	"type": "module",
 	"dependencies": {
-		"@bexis2/bexis2-core-ui": "0.4.60",
+		"@bexis2/bexis2-core-ui": "0.4.63",
 		"@floating-ui/dom": "1.6.8",
 		"@fortawesome/free-solid-svg-icons": "6.6.0",
 		"@sveltejs/adapter-static": "3.0.2",
diff --git a/Console/BExIS.Web.Shell/Areas/DIM/BExIS.Modules.Dim.UI.Svelte/package-lock.json b/Console/BExIS.Web.Shell/Areas/DIM/BExIS.Modules.Dim.UI.Svelte/package-lock.json
diff --git a/Console/BExIS.Web.Shell/Areas/DIM/BExIS.Modules.Dim.UI.Svelte/package.json b/Console/BExIS.Web.Shell/Areas/DIM/BExIS.Modules.Dim.UI.Svelte/package.json
@@ -50,7 +50,7 @@
 	},
 	"type": "module",
 	"dependencies": {
-		"@bexis2/bexis2-core-ui": "0.4.60",
+		"@bexis2/bexis2-core-ui": "0.4.63",
 		"@floating-ui/dom": "1.6.8",
 		"@fortawesome/free-solid-svg-icons": "6.6.0",
 		"@sveltejs/adapter-static": "3.0.2",
diff --git a/Console/BExIS.Web.Shell/Areas/DIM/BExIS.Modules.Dim.UI/Controllers/SubmissionController.cs b/Console/BExIS.Web.Shell/Areas/DIM/BExIS.Modules.Dim.UI/Controllers/SubmissionController.cs
@@ -587,7 +587,7 @@ private bool isEntityValidAgainstBroker(Broker broker, long version, out List<st
         /// <param name="brokerId"></param>
         /// <returns></returns>
         private Tuple<string, string> PrepareData(long datasetVersionId, long brokerId)
-        {
+         {
             Tuple<string, string> tmp = null;
             try
             {
diff --git a/Console/BExIS.Web.Shell/Areas/RPM/BExIS.Modules.Rpm.UI.Svelte/package-lock.json b/Console/BExIS.Web.Shell/Areas/RPM/BExIS.Modules.Rpm.UI.Svelte/package-lock.json
diff --git a/Console/BExIS.Web.Shell/Areas/RPM/BExIS.Modules.Rpm.UI.Svelte/package.json b/Console/BExIS.Web.Shell/Areas/RPM/BExIS.Modules.Rpm.UI.Svelte/package.json
@@ -51,7 +51,7 @@
   },
   "type": "module",
   "dependencies": {
-    "@bexis2/bexis2-core-ui": "0.4.60",
+    "@bexis2/bexis2-core-ui": "0.4.63",
     "@floating-ui/dom": "1.6.8",
     "@sveltejs/adapter-static": "3.0.2",
     "@sveltejs/package": "2.3.2",
diff --git a/Console/BExIS.Web.Shell/Controllers/AccountController.cs b/Console/BExIS.Web.Shell/Controllers/AccountController.cs
@@ -12,10 +12,12 @@
 using System;
 using System.Threading.Tasks;
 using System.Web;
+using System.Web.Helpers;
 using System.Web.Mvc;
 using Vaiona.Web.Extensions;
 using Vaiona.Web.Mvc.Models;
 using Vaiona.Web.Mvc.Modularity;
+using BExIS.App.Bootstrap.Helpers;
 
 namespace BExIS.Web.Shell.Controllers
 {
@@ -301,17 +303,24 @@ public async Task<ActionResult> Login(LoginViewModel model, string returnUrl)
                     if (user != null)
                     {
                         var jwt = JwtHelper.GetTokenByUser(user);
-            
+      
                         // Create a new cookie
-                        HttpCookie cookie = new HttpCookie("jwt", jwt);
-            
+                        HttpCookie cookieJwt = new HttpCookie("jwt", jwt);
+
                         // Set additional properties if needed
-                        cookie.Expires = DateTime.Now.AddDays(1); // Expires in 1 day
-                        cookie.Domain = Request.Url.Host; // Set the domain
-                        cookie.Path = "/"; // Set the path
-            
+                        cookieJwt.Expires = DateTime.Now.AddDays(1); // Expires in 1 day
+                        cookieJwt.Domain = Request.Url.Host; // Set the domain
+                        cookieJwt.Path = "/"; // Set the path
+
+                        var csrfToken = AntiForgeryHelper.GetFormToken();
+                        HttpCookie cookieCsrf = new HttpCookie("XSRF-TOKEN", csrfToken);
+                        // Set additional properties if needed
+                        cookieCsrf.Expires = DateTime.Now.AddDays(1); // Expires in 1 day
+                        cookieCsrf.Domain = Request.Url.Host; // Set the domain
+                        cookieCsrf.Path = "/"; // Set the path
+
                         // Add the cookie to the response
-                        Response.Cookies.Add(cookie);
+                        Response.Cookies.Add(cookieCsrf);
                     }
             
                     var result =
diff --git a/Console/BExIS.Web.Shell/Controllers/HomeController.cs b/Console/BExIS.Web.Shell/Controllers/HomeController.cs
@@ -137,6 +137,7 @@ public ActionResult Nopermission()
 
         [JsonNetFilter]
         [HttpGet]
+        [OutputCache(Duration = 60, VaryByParam = "none")]
         public JsonResult GetApplicationName()
         {
             try
diff --git a/Console/BExIS.Web.Shell/Controllers/TokensController.cs b/Console/BExIS.Web.Shell/Controllers/TokensController.cs
@@ -120,13 +120,12 @@ public async Task<ActionResult> GetToken()
             }
         }
 
-        // GET: /AntiForgeryToken/GetToken
         [HttpGet]
         public ActionResult GetAntiForgeryToken()
         {
             var oldCookieToken = this.HttpContext.Request.Cookies[AntiForgeryConfig.CookieName]?.Value;
-
             string cookieToken, formToken;
+
             // The GetTokens method generates the tokens without rendering a view.
             AntiForgery.GetTokens(oldCookieToken, out cookieToken, out formToken);
 
diff --git a/Console/BExIS.Web.Shell/Themes/Default/Layouts/_svelteLayout.cshtml b/Console/BExIS.Web.Shell/Themes/Default/Layouts/_svelteLayout.cshtml
@@ -23,10 +23,10 @@
 
     @if (Request.IsAuthenticated)
     {
-        using (Html.BeginForm())
-        {
+        //using (Html.BeginForm())
+        //{
             @Html.AntiForgeryToken() <!-- This generates the hidden input field -->
-        }
+        //}
 
         <script>
         // Get the anti-forgery token from the hidden input field
diff --git a/Console/BExIS.Web.Shell/Web.config.sample b/Console/BExIS.Web.Shell/Web.config.sample
@@ -75,6 +75,14 @@
 	<system.web>
 		<globalization uiCulture="en-US" culture="en-US" />
 		<sessionState timeout="120" />
+
+   <!-- improves loading time for iis-->
+		<machineKey
+			validationKey="{validationKey}"
+			decryptionKey="{decryptionKey}"
+			validation="SHA1"
+			decryption="AES" />
+
 		<!-- 20 minutes session timeout, set the cookie name as a cobination of the appname + version-->
 		<compilation targetFramework="4.8" debug="false">
 			<assemblies>

Original file line number	Diff line number	Diff line change
`@@ -50,9 +50,6 @@ public override void OnAuthorization(AuthorizationContext filterContext)`
`50`	`50`	`if (!featurePermissionManager.HasAccessAsync(user.Id, feature.Id).Result)`
`51`	`51`	`{`
`52`	`52`	`filterContext.SetResponse(HttpStatusCode.Forbidden);`
`53`		`-`
`54`		`-`
`55`		`-`
`56`	`53`	`}`
`57`	`54`
`58`	`55`	`// update jwt cookie`