diff --git a/src/Microsoft.AspNet.Mvc.TagHelpers/FormTagHelper.cs b/src/Microsoft.AspNet.Mvc.TagHelpers/FormTagHelper.cs
index 82c51527a9..431020ae0c 100644
--- a/src/Microsoft.AspNet.Mvc.TagHelpers/FormTagHelper.cs
+++ b/src/Microsoft.AspNet.Mvc.TagHelpers/FormTagHelper.cs
@@ -3,6 +3,7 @@
using System;
using System.Collections.Generic;
+using System.ComponentModel;
using Microsoft.AspNet.Mvc.Rendering;
using Microsoft.AspNet.Mvc.ViewFeatures;
using Microsoft.AspNet.Razor.TagHelpers;
@@ -68,7 +69,8 @@ namespace Microsoft.AspNet.Mvc.TagHelpers
///
/// Whether the antiforgery token should be generated.
///
- /// Defaults to false if user provides an action attribute; true otherwise.
+ /// Defaults to false if user provides an action attribute
+ /// or if the method is ; true otherwise.
[HtmlAttributeName(AntiforgeryAttributeName)]
public bool? Antiforgery { get; set; }
@@ -81,6 +83,13 @@ namespace Microsoft.AspNet.Mvc.TagHelpers
[HtmlAttributeName(RouteAttributeName)]
public string Route { get; set; }
+ ///
+ /// The HTTP method to use.
+ ///
+ /// Passed through to the generated HTML in all cases.
+ [EditorBrowsable(EditorBrowsableState.Never)]
+ public string Method { get; set; }
+
///
/// Additional parameters for the route.
///
@@ -122,6 +131,10 @@ namespace Microsoft.AspNet.Mvc.TagHelpers
{
throw new ArgumentNullException(nameof(output));
}
+ if (Method != null)
+ {
+ output.CopyHtmlAttribute(nameof(Method), context);
+ }
var antiforgeryDefault = true;
@@ -195,6 +208,11 @@ namespace Microsoft.AspNet.Mvc.TagHelpers
output.MergeAttributes(tagBuilder);
output.PostContent.AppendHtml(tagBuilder.InnerHtml);
}
+
+ if (string.Equals(Method, FormMethod.Get.ToString(), StringComparison.OrdinalIgnoreCase))
+ {
+ antiforgeryDefault = false;
+ }
}
if (Antiforgery ?? antiforgeryDefault)
diff --git a/src/Microsoft.AspNet.Mvc.ViewFeatures/Rendering/HtmlHelperFormExtensions.cs b/src/Microsoft.AspNet.Mvc.ViewFeatures/Rendering/HtmlHelperFormExtensions.cs
index 34d85ff34d..a0cdd2ae82 100644
--- a/src/Microsoft.AspNet.Mvc.ViewFeatures/Rendering/HtmlHelperFormExtensions.cs
+++ b/src/Microsoft.AspNet.Mvc.ViewFeatures/Rendering/HtmlHelperFormExtensions.cs
@@ -34,7 +34,7 @@ namespace Microsoft.AspNet.Mvc.Rendering
controllerName: null,
routeValues: null,
method: FormMethod.Post,
- suppressAntiforgery: false,
+ antiforgery: null,
htmlAttributes: null);
}
@@ -43,9 +43,11 @@ namespace Microsoft.AspNet.Mvc.Rendering
/// match the current request.
///
/// The instance this method extends.
- ///
- /// If true, suppresses the generation an <input> of type "hidden" with an antiforgery token. By
- /// default <form> elements will automatically include an antiforgery token.
+ ///
+ /// If true, <form> elements will include an antiforgery token.
+ /// If false, suppresses the generation an <input> of type "hidden" with an antiforgery token.
+ /// If null, <form> elements will include an antiforgery token only if
+ /// is not .
///
///
/// An instance which renders the </form> end tag when disposed.
@@ -53,7 +55,7 @@ namespace Microsoft.AspNet.Mvc.Rendering
///
/// In this context, "renders" means the method writes its output using .
///
- public static MvcForm BeginForm(this IHtmlHelper htmlHelper, bool suppressAntiforgery)
+ public static MvcForm BeginForm(this IHtmlHelper htmlHelper, bool? antiforgery)
{
if (htmlHelper == null)
{
@@ -66,7 +68,7 @@ namespace Microsoft.AspNet.Mvc.Rendering
controllerName: null,
routeValues: null,
method: FormMethod.Post,
- suppressAntiforgery: suppressAntiforgery,
+ antiforgery: antiforgery,
htmlAttributes: null);
}
@@ -94,7 +96,7 @@ namespace Microsoft.AspNet.Mvc.Rendering
controllerName: null,
routeValues: null,
method: method,
- suppressAntiforgery: false,
+ antiforgery: null,
htmlAttributes: null);
}
@@ -130,7 +132,7 @@ namespace Microsoft.AspNet.Mvc.Rendering
controllerName: null,
routeValues: null,
method: method,
- suppressAntiforgery: false,
+ antiforgery: null,
htmlAttributes: htmlAttributes);
}
@@ -140,9 +142,11 @@ namespace Microsoft.AspNet.Mvc.Rendering
///
/// The instance this method extends.
/// The HTTP method for processing the form, either GET or POST.
- ///
- /// If true, suppresses the generation an <input> of type "hidden" with an antiforgery token. By
- /// default <form> elements will automatically include an antiforgery token.
+ ///
+ /// If true, <form> elements will include an antiforgery token.
+ /// If false, suppresses the generation an <input> of type "hidden" with an antiforgery token.
+ /// If null, <form> elements will include an antiforgery token only if
+ /// is not .
///
///
/// An that contains the HTML attributes for the element. Alternatively, an
@@ -158,7 +162,7 @@ namespace Microsoft.AspNet.Mvc.Rendering
public static MvcForm BeginForm(
this IHtmlHelper htmlHelper,
FormMethod method,
- bool suppressAntiforgery,
+ bool? antiforgery,
object htmlAttributes)
{
if (htmlHelper == null)
@@ -171,7 +175,7 @@ namespace Microsoft.AspNet.Mvc.Rendering
controllerName: null,
routeValues: null,
method: method,
- suppressAntiforgery: suppressAntiforgery,
+ antiforgery: antiforgery,
htmlAttributes: htmlAttributes);
}
@@ -205,7 +209,7 @@ namespace Microsoft.AspNet.Mvc.Rendering
controllerName: null,
routeValues: routeValues,
method: FormMethod.Post,
- suppressAntiforgery: false,
+ antiforgery: null,
htmlAttributes: null);
}
@@ -237,7 +241,7 @@ namespace Microsoft.AspNet.Mvc.Rendering
controllerName,
routeValues: null,
method: FormMethod.Post,
- suppressAntiforgery: false,
+ antiforgery: null,
htmlAttributes: null);
}
@@ -277,7 +281,7 @@ namespace Microsoft.AspNet.Mvc.Rendering
controllerName,
routeValues,
FormMethod.Post,
- suppressAntiforgery: false,
+ antiforgery: null,
htmlAttributes: null);
}
@@ -311,7 +315,7 @@ namespace Microsoft.AspNet.Mvc.Rendering
controllerName,
routeValues: null,
method: method,
- suppressAntiforgery: false,
+ antiforgery: null,
htmlAttributes: null);
}
@@ -353,7 +357,7 @@ namespace Microsoft.AspNet.Mvc.Rendering
controllerName,
routeValues,
method,
- suppressAntiforgery: false,
+ antiforgery: null,
htmlAttributes: null);
}
@@ -393,7 +397,7 @@ namespace Microsoft.AspNet.Mvc.Rendering
controllerName,
routeValues: null,
method: method,
- suppressAntiforgery: false,
+ antiforgery: null,
htmlAttributes: htmlAttributes);
}
@@ -426,7 +430,7 @@ namespace Microsoft.AspNet.Mvc.Rendering
routeName: null,
routeValues: routeValues,
method: FormMethod.Post,
- suppressAntiforgery: false,
+ antiforgery: null,
htmlAttributes: null);
}
@@ -442,9 +446,11 @@ namespace Microsoft.AspNet.Mvc.Rendering
/// instance containing the route
/// parameters.
///
- ///
- /// If true, suppresses the generation an <input> of type "hidden" with an antiforgery token. By
- /// default <form> elements will automatically include an antiforgery token.
+ ///
+ /// If true, <form> elements will include an antiforgery token.
+ /// If false, suppresses the generation an <input> of type "hidden" with an antiforgery token.
+ /// If null, <form> elements will include an antiforgery token only if
+ /// is not .
///
///
/// An instance which renders the </form> end tag when disposed.
@@ -452,7 +458,7 @@ namespace Microsoft.AspNet.Mvc.Rendering
///
/// In this context, "renders" means the method writes its output using .
///
- public static MvcForm BeginRouteForm(this IHtmlHelper htmlHelper, object routeValues, bool suppressAntiforgery)
+ public static MvcForm BeginRouteForm(this IHtmlHelper htmlHelper, object routeValues, bool? antiforgery)
{
if (htmlHelper == null)
{
@@ -463,7 +469,7 @@ namespace Microsoft.AspNet.Mvc.Rendering
routeName: null,
routeValues: routeValues,
method: FormMethod.Post,
- suppressAntiforgery: suppressAntiforgery,
+ antiforgery: antiforgery,
htmlAttributes: null);
}
@@ -490,7 +496,7 @@ namespace Microsoft.AspNet.Mvc.Rendering
routeName,
routeValues: null,
method: FormMethod.Post,
- suppressAntiforgery: false,
+ antiforgery: null,
htmlAttributes: null);
}
@@ -500,9 +506,11 @@ namespace Microsoft.AspNet.Mvc.Rendering
///
/// The instance this method extends.
/// The name of the route.
- ///
- /// If true, suppresses the generation an <input> of type "hidden" with an antiforgery token. By
- /// default <form> elements will automatically include an antiforgery token.
+ ///
+ /// If true, <form> elements will include an antiforgery token.
+ /// If false, suppresses the generation an <input> of type "hidden" with an antiforgery token.
+ /// If null, <form> elements will include an antiforgery token only if
+ /// is not .
///
///
/// An instance which renders the </form> end tag when disposed.
@@ -510,7 +518,7 @@ namespace Microsoft.AspNet.Mvc.Rendering
///
/// In this context, "renders" means the method writes its output using .
///
- public static MvcForm BeginRouteForm(this IHtmlHelper htmlHelper, string routeName, bool suppressAntiforgery)
+ public static MvcForm BeginRouteForm(this IHtmlHelper htmlHelper, string routeName, bool? antiforgery)
{
if (htmlHelper == null)
{
@@ -521,7 +529,7 @@ namespace Microsoft.AspNet.Mvc.Rendering
routeName,
routeValues: null,
method: FormMethod.Post,
- suppressAntiforgery: suppressAntiforgery,
+ antiforgery: antiforgery,
htmlAttributes: null);
}
@@ -558,7 +566,7 @@ namespace Microsoft.AspNet.Mvc.Rendering
routeName,
routeValues,
FormMethod.Post,
- suppressAntiforgery: false,
+ antiforgery: null,
htmlAttributes: null);
}
@@ -589,7 +597,7 @@ namespace Microsoft.AspNet.Mvc.Rendering
routeName,
routeValues: null,
method: method,
- suppressAntiforgery: false,
+ antiforgery: null,
htmlAttributes: null);
}
@@ -628,7 +636,7 @@ namespace Microsoft.AspNet.Mvc.Rendering
routeName,
routeValues,
method,
- suppressAntiforgery: false,
+ antiforgery: null,
htmlAttributes: null);
}
@@ -665,7 +673,7 @@ namespace Microsoft.AspNet.Mvc.Rendering
routeName,
routeValues: null,
method: method,
- suppressAntiforgery: false,
+ antiforgery: null,
htmlAttributes: htmlAttributes);
}
}
diff --git a/src/Microsoft.AspNet.Mvc.ViewFeatures/Rendering/IHtmlHelper.cs b/src/Microsoft.AspNet.Mvc.ViewFeatures/Rendering/IHtmlHelper.cs
index babb080eaa..bdcde2e7a9 100644
--- a/src/Microsoft.AspNet.Mvc.ViewFeatures/Rendering/IHtmlHelper.cs
+++ b/src/Microsoft.AspNet.Mvc.ViewFeatures/Rendering/IHtmlHelper.cs
@@ -114,9 +114,11 @@ namespace Microsoft.AspNet.Mvc.Rendering
/// instance containing the route parameters.
///
/// The HTTP method for processing the form, either GET or POST.
- ///
- /// If true, suppresses the generation an <input> of type "hidden" with an antiforgery token. By
- /// default <form> elements will automatically include an antiforgery token.
+ ///
+ /// If true, <form> elements will include an antiforgery token.
+ /// If false, suppresses the generation an <input> of type "hidden" with an antiforgery token.
+ /// If null, <form> elements will include an antiforgery token only if
+ /// is not .
///
///
/// An that contains the HTML attributes for the element. Alternatively, an
@@ -133,7 +135,7 @@ namespace Microsoft.AspNet.Mvc.Rendering
string controllerName,
object routeValues,
FormMethod method,
- bool suppressAntiforgery,
+ bool? antiforgery,
object htmlAttributes);
///
@@ -148,8 +150,11 @@ namespace Microsoft.AspNet.Mvc.Rendering
/// instance containing the route parameters.
///
/// The HTTP method for processing the form, either GET or POST.
- ///
- /// Determines whether or not to include an <input> of type "hidden" with an antiforgery token.
+ ///
+ /// If true, <form> elements will include an antiforgery token.
+ /// If false, suppresses the generation an <input> of type "hidden" with an antiforgery token.
+ /// If null, <form> elements will include an antiforgery token only if
+ /// is not .
///
///
/// An that contains the HTML attributes for the element. Alternatively, an
@@ -165,7 +170,7 @@ namespace Microsoft.AspNet.Mvc.Rendering
string routeName,
object routeValues,
FormMethod method,
- bool suppressAntiforgery,
+ bool? antiforgery,
object htmlAttributes);
///
diff --git a/src/Microsoft.AspNet.Mvc.ViewFeatures/ViewFeatures/HtmlHelper.cs b/src/Microsoft.AspNet.Mvc.ViewFeatures/ViewFeatures/HtmlHelper.cs
index 7d0ce01fa7..29f283453b 100644
--- a/src/Microsoft.AspNet.Mvc.ViewFeatures/ViewFeatures/HtmlHelper.cs
+++ b/src/Microsoft.AspNet.Mvc.ViewFeatures/ViewFeatures/HtmlHelper.cs
@@ -288,7 +288,7 @@ namespace Microsoft.AspNet.Mvc.ViewFeatures
string controllerName,
object routeValues,
FormMethod method,
- bool suppressAntiforgery,
+ bool? antiforgery,
object htmlAttributes)
{
// Push the new FormContext; MvcForm.GenerateEndForm() does the corresponding pop.
@@ -297,7 +297,7 @@ namespace Microsoft.AspNet.Mvc.ViewFeatures
CanRenderAtEndOfForm = true
};
- return GenerateForm(actionName, controllerName, routeValues, method, suppressAntiforgery, htmlAttributes);
+ return GenerateForm(actionName, controllerName, routeValues, method, antiforgery, htmlAttributes);
}
///
@@ -305,7 +305,7 @@ namespace Microsoft.AspNet.Mvc.ViewFeatures
string routeName,
object routeValues,
FormMethod method,
- bool suppressAntiforgery,
+ bool? antiforgery,
object htmlAttributes)
{
// Push the new FormContext; MvcForm.GenerateEndForm() does the corresponding pop.
@@ -314,7 +314,7 @@ namespace Microsoft.AspNet.Mvc.ViewFeatures
CanRenderAtEndOfForm = true
};
- return GenerateRouteForm(routeName, routeValues, method, suppressAntiforgery, htmlAttributes);
+ return GenerateRouteForm(routeName, routeValues, method, antiforgery, htmlAttributes);
}
///
@@ -871,9 +871,11 @@ namespace Microsoft.AspNet.Mvc.ViewFeatures
/// instance containing the route parameters.
///
/// The HTTP method for processing the form, either GET or POST.
- ///
- /// If true, suppresses the generation an <input> of type "hidden" with an antiforgery token. By
- /// default <form> elements will automatically include an antiforgery token.
+ ///
+ /// If true, <form> elements will include an antiforgery token.
+ /// If false, suppresses the generation an <input> of type "hidden" with an antiforgery token.
+ /// If null, <form> elements will include an antiforgery token only if
+ /// is not .
///
///
/// An that contains the HTML attributes for the element. Alternatively, an
@@ -890,7 +892,7 @@ namespace Microsoft.AspNet.Mvc.ViewFeatures
string controllerName,
object routeValues,
FormMethod method,
- bool suppressAntiforgery,
+ bool? antiforgery,
object htmlAttributes)
{
var tagBuilder = _htmlGenerator.GenerateForm(
@@ -906,7 +908,8 @@ namespace Microsoft.AspNet.Mvc.ViewFeatures
tagBuilder.WriteTo(ViewContext.Writer, _htmlEncoder);
}
- if (!suppressAntiforgery)
+ var shouldGenerateAntiforgery = antiforgery.HasValue ? antiforgery.Value : method != FormMethod.Get;
+ if (shouldGenerateAntiforgery)
{
ViewContext.FormContext.EndOfFormContent.Add(_htmlGenerator.GenerateAntiforgery(ViewContext));
ViewContext.FormContext.HasAntiforgeryToken = true;
@@ -927,9 +930,11 @@ namespace Microsoft.AspNet.Mvc.ViewFeatures
/// instance containing the route parameters.
///
/// The HTTP method for processing the form, either GET or POST.
- ///
- /// If true, suppresses the generation an <input> of type "hidden" with an antiforgery token. By
- /// default <form> elements will automatically include an antiforgery token.
+ ///
+ /// If true, <form> elements will include an antiforgery token.
+ /// If false, suppresses the generation an <input> of type "hidden" with an antiforgery token.
+ /// If null, <form> elements will include an antiforgery token only if
+ /// is not .
///
///
/// An that contains the HTML attributes for the element. Alternatively, an
@@ -945,7 +950,7 @@ namespace Microsoft.AspNet.Mvc.ViewFeatures
string routeName,
object routeValues,
FormMethod method,
- bool suppressAntiforgery,
+ bool? antiforgery,
object htmlAttributes)
{
var tagBuilder = _htmlGenerator.GenerateRouteForm(
@@ -960,7 +965,8 @@ namespace Microsoft.AspNet.Mvc.ViewFeatures
tagBuilder.WriteTo(ViewContext.Writer, _htmlEncoder);
}
- if (!suppressAntiforgery)
+ var shouldGenerateAntiforgery = antiforgery.HasValue ? antiforgery.Value : method != FormMethod.Get;
+ if (shouldGenerateAntiforgery)
{
ViewContext.FormContext.EndOfFormContent.Add(_htmlGenerator.GenerateAntiforgery(ViewContext));
ViewContext.FormContext.HasAntiforgeryToken = true;
diff --git a/test/Microsoft.AspNet.Mvc.FunctionalTests/compiler/resources/HtmlGenerationWebSite.HtmlGeneration_Home.Product.Encoded.html b/test/Microsoft.AspNet.Mvc.FunctionalTests/compiler/resources/HtmlGenerationWebSite.HtmlGeneration_Home.Product.Encoded.html
index 8e76207964..d40a62e45e 100644
--- a/test/Microsoft.AspNet.Mvc.FunctionalTests/compiler/resources/HtmlGenerationWebSite.HtmlGeneration_Home.Product.Encoded.html
+++ b/test/Microsoft.AspNet.Mvc.FunctionalTests/compiler/resources/HtmlGenerationWebSite.HtmlGeneration_Home.Product.Encoded.html
@@ -4,7 +4,7 @@
-