Swagger: 'Post' method in swagger is not working for Oqtane module

[kasif]

Hello Concerned Authority,

I am testing API that I have defined in the controller. When using "Get" method through swagger, it is working fine and i am getting the results.
However, when I am using "Post" method, it always gives me "Bad Request".

I tried to test "Post Method" for other module as well but i am seeing "Bad Request" error response every time.

Could you please let me know why I am seeing this?

Attache is the screenshots of Get and Post method.

[sbwalker]

@kasif Oqtane requires a valid antiforgery token when calling POST, PUT, DELETE methods and using cookie authentication:

Oqtane.Server\Security\AutoValidateAntiforgeryTokenFilter.cs

[kasif]

Hey @sbwalker, it was great hearing from you and your answer makes sense.

However, I want to let you know that when I am updating any module from the Oqtane UI with "Admin" rights, I am able to ADD, UPDATE, DELETE the content of the field/module.
But I am unable to do the same from Swagger(logged in as Admin).

Do we need to explicitly customize (AutoValidateAntiforgeryTokenFilter.cs) for Swagger to work?
If yes, any reference document would be of great help.

Thanks.

[sbwalker]

@kasif I am guessing this is because when you running Oqtane it is using HttpClient and the Antiforgery token is automatically added as a DefaultRequestHeader when making calls to the API:

Oqtane.Client\Services\ServiceBase.cs

Postman would need to add the DefaultRequestHeader as well ie. X-XSRF-TOKEN-HEADER would need to be set to a valid Antiforgery token.

Another option would be to use a bearer token on your API requests, as AutoValidateAntiforgeryTokenFilter ignores antiforgery validation when a bearer token is used (because antiforgery is only to prevent cookie tampering). You can get a bearer token by going to User Management, Settings tab, and Token section.

[sbwalker]

I suppose one more option would be to modify AutoValidateAntiforgeryTokenFilter.cs to ignore antiforgery validation in development environments - although research would need to be done to determine if this is safe and does not expose the framework to vulnerabilities.