Merge pull request #490 from aspnetboilerplate/maliming/patch-1

Fixed the issue that anti forgery failed after user identity changed.

Author: demirmusa

aspnet-core/src/AbpCompanyName.AbpProjectName.Web.Host/Controllers/AntiForgeryController.cs

@@ -1,20 +1,30 @@
+using System.Threading.Tasks;
+using Abp.Web.Security.AntiForgery;
 using Microsoft.AspNetCore.Antiforgery;
 using AbpCompanyName.AbpProjectName.Controllers;
+using Microsoft.AspNetCore.Mvc;
 
 namespace AbpCompanyName.AbpProjectName.Web.Host.Controllers
 {
     public class AntiForgeryController : AbpProjectNameControllerBase
     {
         private readonly IAntiforgery _antiforgery;
+        private readonly IAbpAntiForgeryManager _antiForgeryManager;
 
-        public AntiForgeryController(IAntiforgery antiforgery)
+        public AntiForgeryController(IAntiforgery antiforgery, IAbpAntiForgeryManager antiForgeryManager)
         {
             _antiforgery = antiforgery;
+            _antiForgeryManager = antiForgeryManager;
         }
 
         public void GetToken()
         {
             _antiforgery.SetCookieTokenAndHeader(HttpContext);
         }
+
+        public void SetCookie()
+        {
+            _antiForgeryManager.SetCookie(HttpContext);
+        }
     }
 }

aspnet-core/src/AbpCompanyName.AbpProjectName.Web.Host/Controllers/HomeController.cs

@@ -13,17 +13,13 @@ public class HomeController : AbpProjectNameControllerBase
     {
         private readonly INotificationPublisher _notificationPublisher;
 
-        private readonly IAbpAntiForgeryManager _abpAntiForgeryManager;
-
-        public HomeController(INotificationPublisher notificationPublisher, IAbpAntiForgeryManager abpAntiForgeryManager)
+        public HomeController(INotificationPublisher notificationPublisher)
         {
             _notificationPublisher = notificationPublisher;
-            _abpAntiForgeryManager = abpAntiForgeryManager;
         }
 
         public IActionResult Index()
         {
-            _abpAntiForgeryManager.SetCookie(HttpContext);
             return Redirect("/swagger");
         }
 

aspnet-core/src/AbpCompanyName.AbpProjectName.Web.Host/Startup/Startup.cs

@@ -119,8 +119,7 @@ public void Configure(IApplicationBuilder app,  ILoggerFactory loggerFactory)
                 endpoints.MapControllerRoute("default", "{controller=Home}/{action=Index}/{id?}");
                 endpoints.MapControllerRoute("defaultWithArea", "{area}/{controller=Home}/{action=Index}/{id?}");
             });
-
-
+          
             // Enable middleware to serve generated Swagger as a JSON endpoint
             app.UseSwagger();
             // Enable middleware to serve swagger-ui assets (HTML, JS, CSS etc.)

aspnet-core/src/AbpCompanyName.AbpProjectName.Web.Host/wwwroot/swagger/ui/index.html

@@ -70,8 +70,21 @@
     <script src="swagger-ui-standalone-preset.js"></script>
     <script src="ui/abp.js"></script>
     <script src="ui/abp.swagger.js"></script>
+
     <script>
         window.onload = function () {
+            var authToken = abp.auth.getToken();
+            if (authToken) {
+                fetch("/AntiForgery/SetCookie",
+                    {
+                        headers: {
+                            "Authorization": 'Bearer ' + authToken
+                        }
+                    });
+            } else {
+                fetch("/AntiForgery/SetCookie");
+            }
+
             var configObject = JSON.parse('%(ConfigObject)');
 
             // Apply mandatory parameters
@@ -109,16 +122,12 @@
                                             lineHeight: "normal"
                                         },
                                         onClick: function () {
-                                            var authorizeButton = document.getElementById('authorize');
                                             if (abp.auth.getToken()) {
                                                 abp.swagger.logout();
-                                                authorizeButton.innerText = getAuthorizeButtonText();
-                                                authorizeButton.className = 'btn ' + getAuthorizeButtonCssClass();
+                                                location.reload();
                                             } else {
                                                 abp.swagger.openAuthDialog(function () {
-                                                    authorizeButton.innerText = getAuthorizeButtonText();
-                                                    authorizeButton.className = 'btn ' + getAuthorizeButtonCssClass();
-                                                    abp.swagger.closeAuthDialog();
+                                                    location.reload();
                                                 });
                                             }
                                         }