<%@ Page Title="Antiforgery Token" Language="C#" MasterPageFile="~/Site.master" AutoEventWireup="true" %>
<%@ Register Assembly="AjaxUploader" Namespace="AjaxUploader.Controls" TagPrefix="au" %> 
<asp:Content ID="TitleContent" ContentPlaceHolderID="TitleContent" runat="server">Antiforgery Token - AjaxUploader v5.0 Demos</asp:Content>
<asp:Content ID="HeaderContent" ContentPlaceHolderID="HeaderTitle" runat="server">Antiforgery Token</asp:Content> 
<asp:Content ID="BodyContent" ContentPlaceHolderID="MainContent" runat="server"> 
<div class="demo-card"> <div class="demo-card-header">Antiforgery Token</div> <div class="demo-card-body"> <p class="demo-description"> Protect uploads with antiforgery tokens. Set <code>EnableAntiforgery="true"</code> to automatically include the ViewState validation token with upload requests,
 preventing CSRF attacks. Use <code>ViewStateUserKey</code> in code-behind for
 per-session token binding.
 </p> <au:AjaxFileUpload ID="Uploader1" runat="server"
 AllowMultiple="true"
 AutoUpload="true"
 EnableAntiforgery="true"
 ShowProgress="true"
 ButtonText="Upload with CSRF Protection" /> <div class="code-panel"> <pre><code>&lt;%-- ASPX markup --%&gt;
&lt;au:AjaxFileUpload ID="Uploader1" runat="server"
 AllowMultiple="true"
 AutoUpload="true"
 EnableAntiforgery="true"
 ShowProgress="true" /&gt;

&lt;%-- Code-behind: bind ViewStateUserKey per session --%&gt;
protected override void OnInit(EventArgs e)
{
 base.OnInit(e);
 ViewStateUserKey = Session.SessionID;
}

&lt;%-- JavaScript API: pass the token in custom headers --%&gt;
AjaxUploader.create(el, {
 uploadUrl: '<%= ResolveUrl("~/ajaxupload.axd/upload") %>',
 headers: {
 'X-AntiForgery-Token': document.getElementById(
 '__VIEWSTATE'
 ).value
 }
});

&lt;%-- web.config: enable ViewState MAC validation --%&gt;
&lt;system.web&gt;
 &lt;pages enableViewStateMac="true" /&gt;
&lt;/system.web&gt;</code></pre> </div> </div>
</div> 
</asp:Content>
