Skip to content

Server validation with a validator component 8.0 #30925

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
guardrex merged 3 commits into from
Nov 3, 2023
Merged

Server validation with a validator component 8.0 #30925

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
5370f58
Server validation with a validator component 8.0
guardrex Nov 3, 2023
cc91c55
Updates
guardrex Nov 3, 2023
100d414
Updates
guardrex Nov 3, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 9 additions & 5 deletions aspnetcore/blazor/file-uploads.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -640,7 +640,7 @@ The following `FileUpload2` component:
The following controller in the web API project saves uploaded files from the client.

> [!IMPORTANT]
> The controller in this section is intended for use in a separate web API project from the Blazor app. The web API should [mitigate Cross-Site Request Forgery (XSRF/CSRF) attacks](xref:security/anti-request-forgery) if users are authenticated.
> The controller in this section is intended for use in a separate web API project from the Blazor app. The web API should [mitigate Cross-Site Request Forgery (XSRF/CSRF) attacks](xref:security/anti-request-forgery) if file upload users are authenticated.

:::moniker range="= aspnetcore-6.0"

Expand All @@ -655,8 +655,6 @@ Because the example uses the app's [environment](xref:blazor/fundamentals/enviro

> [!WARNING]
> The example saves files without scanning their contents, and the guidance in this article doesn't take into account additional security best practices for uploaded files. On staging and production systems, disable execute permission on the upload folder and scan files with an anti-virus/anti-malware scanner API immediately after upload. For more information, see <xref:mvc/models/file-uploads#security-considerations>.
>
> Additionally, the web API should [mitigate Cross-Site Request Forgery (XSRF/CSRF) attacks](xref:security/anti-request-forgery) if users are authenticated.

`Controllers/FilesaveController.cs`:

Expand Down Expand Up @@ -1028,8 +1026,6 @@ Because the example uses the app's [environment](xref:blazor/fundamentals/enviro

> [!WARNING]
> The example saves files without scanning their contents, and the guidance in this article doesn't take into account additional security best practices for uploaded files. On staging and production systems, disable execute permission on the upload folder and scan files with an anti-virus/anti-malware scanner API immediately after upload. For more information, see <xref:mvc/models/file-uploads#security-considerations>.
>
> Additionally, the web API should [mitigate Cross-Site Request Forgery (XSRF/CSRF) attacks](xref:security/anti-request-forgery) if users are authenticated.

In the following example, update the shared project's namespace to match the shared project if a shared project is supplying the `UploadResult` class.

Expand Down Expand Up @@ -1141,6 +1137,14 @@ In the preceding code, <xref:System.IO.Path.GetRandomFileName%2A> is called to g

The server app must register controller services and map controller endpoints. For more information, see <xref:mvc/controllers/routing>.

<!--

HOLD: Tracking anti-request forgery work for this article in the UE tracking issue.

We recommend adding controller services with <xref:Microsoft.Extensions.DependencyInjection.MvcServiceCollectionExtensions.AddControllersWithViews%2A> in order to automatically [mitigate Cross-Site Request Forgery (XSRF/CSRF) attacks](xref:security/anti-request-forgery). If you merely use <xref:Microsoft.Extensions.DependencyInjection.MvcServiceCollectionExtensions.AddControllers%2A>, anti-forgery is ***not*** enabled automatically. For more information, see <xref:mvc/controllers/routing>.

-->

## Cancel a file upload

A file upload component can detect when a user has cancelled an upload by using a <xref:System.Threading.CancellationToken> when calling into the <xref:Microsoft.AspNetCore.Components.Forms.IBrowserFile.OpenReadStream%2A?displayProperty=nameWithType> or <xref:System.IO.StreamReader.ReadAsync%2A?displayProperty=nameWithType>.
Expand Down
Loading