{"action":"created","issue":{"url":"https://api.github.com/repos/aspnet/Antiforgery/issues/112","repository_url":"https://api.github.com/repos/aspnet/Antiforgery","labels_url":"https://api.github.com/repos/aspnet/Antiforgery/issues/112/labels{/name}","comments_url":"https://api.github.com/repos/aspnet/Antiforgery/issues/112/comments","events_url":"https://api.github.com/repos/aspnet/Antiforgery/issues/112/events","html_url":"https://github.com/aspnet/Antiforgery/issues/112","id":190089312,"number":112,"title":"Handling a failed validation","user":{"login":"strohhut","id":15095059,"avatar_url":"https://avatars.githubusercontent.com/u/15095059?v=3","gravatar_id":"","url":"https://api.github.com/users/strohhut","html_url":"https://github.com/strohhut","followers_url":"https://api.github.com/users/strohhut/followers","following_url":"https://api.github.com/users/strohhut/following{/other_user}","gists_url":"https://api.github.com/users/strohhut/gists{/gist_id}","starred_url":"https://api.github.com/users/strohhut/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/strohhut/subscriptions","organizations_url":"https://api.github.com/users/strohhut/orgs","repos_url":"https://api.github.com/users/strohhut/repos","events_url":"https://api.github.com/users/strohhut/events{/privacy}","received_events_url":"https://api.github.com/users/strohhut/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-11-17T16:06:28Z","updated_at":"2016-11-21T12:51:41Z","closed_at":null,"body":"When I use `UseStatusCodePagesWithReExecute` and get a 404 is there any way I can know that the cause is that the validation of the antiforgery token failed?\r\n\r\nI tried getting this information via `Features` but it was no success:\r\n\r\n```CSharp\r\n[Route(\"~/Error/{code}\")]\r\npublic IActionResult Error(string code /*400 when validation failed*/)\r\n{\r\n    var itsNull1 = HttpContext.Features.Get<IAntiforgery>();\r\n    var itsNull2 = HttpContext.Features.Get<IAntiforgeryAdditionalDataProvider>();\r\n    var itsNull3 = HttpContext.Features.Get<IAntiforgeryFeature>();\r\n    var itsNull4 = HttpContext.Features.Get<AntiforgeryFeature>();\r\n    var itsNull5 = HttpContext.Features.Get<AntiforgeryValidationException>();\r\n\r\n    var status = Response.StatusCode; // 200 when validation failed\r\n    ...\r\n```\r\n\r\nOne thing I found is that normally the following is true inside the `Error` action: `code = Response.StatusCode.ToString()`. It's true for instance when I return a 400 StatusCodeResult myself from an action. Now when the `Error` action is executed because the token validation failed then `code` is `\"400\"` and `Response.StatusCode` is `200` for some reason.\r\n\r\nIs it safe to assume that when `code == \"400\" && Response.StatusCode == 200` Antiforgery is responsible?\r\n"},"comment":{"url":"https://api.github.com/repos/aspnet/Antiforgery/issues/comments/261928701","html_url":"https://github.com/aspnet/Antiforgery/issues/112#issuecomment-261928701","issue_url":"https://api.github.com/repos/aspnet/Antiforgery/issues/112","id":261928701,"user":{"login":"strohhut","id":15095059,"avatar_url":"https://avatars.githubusercontent.com/u/15095059?v=3","gravatar_id":"","url":"https://api.github.com/users/strohhut","html_url":"https://github.com/strohhut","followers_url":"https://api.github.com/users/strohhut/followers","following_url":"https://api.github.com/users/strohhut/following{/other_user}","gists_url":"https://api.github.com/users/strohhut/gists{/gist_id}","starred_url":"https://api.github.com/users/strohhut/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/strohhut/subscriptions","organizations_url":"https://api.github.com/users/strohhut/orgs","repos_url":"https://api.github.com/users/strohhut/repos","events_url":"https://api.github.com/users/strohhut/events{/privacy}","received_events_url":"https://api.github.com/users/strohhut/received_events","type":"User","site_admin":false},"created_at":"2016-11-21T12:51:41Z","updated_at":"2016-11-21T12:51:41Z","body":"I found that my `ErrorController` isn't called at all after a failed validation if I have `services.AddAntiforgery` before `services.AddAuthentication(); services.AddAuthorization();` inside `ConfigureServices`."}}
{"actor":{"display_login":"strohhut"}}