<%@ Page Title="Antiforgery Token" Language="C#" MasterPageFile="~/Site.master" AutoEventWireup="true" %>
<%@ Register Assembly="AjaxUploader" Namespace="AjaxUploader.Controls" TagPrefix="au" %>

<asp:Content ID="TitleContent" ContentPlaceHolderID="TitleContent" runat="server">Antiforgery Token - AjaxUploader v5.0 Demos</asp:Content>
<asp:Content ID="HeaderContent" ContentPlaceHolderID="HeaderTitle" runat="server">Antiforgery Token</asp:Content>

<asp:Content ID="BodyContent" ContentPlaceHolderID="MainContent" runat="server">

<div class="demo-card">
    <div class="demo-card-header">Antiforgery Token</div>
    <div class="demo-card-body">
        <p class="demo-description">
            Protect uploads with antiforgery tokens. Set <code>EnableAntiforgery="true"</code>
            to automatically include the ViewState validation token with upload requests,
            preventing CSRF attacks. Use <code>ViewStateUserKey</code> in code-behind for
            per-session token binding.
        </p>

        <au:AjaxFileUpload ID="Uploader1" runat="server"
            AllowMultiple="true"
            AutoUpload="true"
            EnableAntiforgery="true"
            ShowProgress="true"
            ButtonText="Upload with CSRF Protection" />

        <div class="code-panel">
            <pre><code>&lt;%-- ASPX markup --%&gt;
&lt;au:AjaxFileUpload ID="Uploader1" runat="server"
    AllowMultiple="true"
    AutoUpload="true"
    EnableAntiforgery="true"
    ShowProgress="true" /&gt;

&lt;%-- Code-behind: bind ViewStateUserKey per session --%&gt;
protected override void OnInit(EventArgs e)
{
    base.OnInit(e);
    ViewStateUserKey = Session.SessionID;
}

&lt;%-- JavaScript API: pass the token in custom headers --%&gt;
AjaxUploader.create(el, {
    uploadUrl: '<%= ResolveUrl("~/ajaxupload.axd/upload") %>',
    headers: {
        'X-AntiForgery-Token': document.getElementById(
            '__VIEWSTATE'
        ).value
    }
});

&lt;%-- web.config: enable ViewState MAC validation --%&gt;
&lt;system.web&gt;
    &lt;pages enableViewStateMac="true" /&gt;
&lt;/system.web&gt;</code></pre>
        </div>
    </div>
</div>

</asp:Content>
