How to catch HttpAntiForgeryException in ASP.NET MVC

Question

I'm using the AntiForgeryToken in my ASP.NET MVC forms. If I deactivate cookies in my browser and send the from, I'd get following error message:

A required anti-forgery token was not supplied or was invalid.

How can I prevent this message from showing? I would prefer redirecting the user to another page.

I've activated customErrors and included this HandleError in my controller:

[HandleError(ExceptionType=typeof(HttpAntiForgeryException), View="Index")]
public class MyController : Controller
{
...
}

The HandleError is ignored.

Has anyone got a solution?

Answer 1

It works fine for me :)

I notice you've specified the error view as "Index" - is it possible there's an error in this view that only shows up in this error situation? HandleErrorAttribute will be displaying this "Index" view without executing the action itself - if your Index action method is setting objects in ViewData that the View relies on to work, then the error won't be handled properly and you'll get the ugly yelllow page.

If that doesn't fix it, have you tested error handling on other errors to make it works? Some things that can cause errors to not be handled:

1. Custom errors aren't on in your web.config
2. An error in your view
3. An error in the master page that the view uses.

Answer 2

I think the point of the anti-forgery token is to just deter requests made on behalf of an authenticated user by another website. So if you can legitimately access the form without cookies, that means you can access it without being authenticated so there shouldn't be any need to protect it from CSRF attacks.

I hope someone corrects me if I'm wrong though.