I'm trying to save data using ajax in MVC 5. When I'm posting form data without #Html.AntiForgeryToken(), it's working nicely. But it's showing me Object reference not set to an instance of an object error for using #Html.AntiForgeryToken(). Here is my ajax code:
$.ajax({
type: "POST",
url: "/Employees/Create",
data: data,
async: false,
success: function (result) {
if (result == 1) {
window.location.href = '/Employees';
}
else {
$('#error-span').html('Error in insert.');
}
},
error: function () {
alert('Failed');
}
});
Here is my controller method:
[HttpPost]
[ValidateAntiForgeryToken]
public ActionResult Create([Bind(Include = "Address,JoinDate,DoB,Gender,BloodGroup,Email,LastName,FirstName,Mobile,UpdateDate,UpdatedBy,Status,EmployeeType,CreatedBy,CreateDate,DesignationId")] EmpDetail empDetail)
{
try
{
Regex rgx = new Regex("[^a-zA-Z0-9 - .]");
empDetail.FirstName = CultureInfo.CurrentCulture.TextInfo.ToTitleCase(rgx.Replace(empDetail.FirstName, "").ToLower()).Trim();
empDetail.LastName = CultureInfo.CurrentCulture.TextInfo.ToTitleCase(rgx.Replace(empDetail.LastName, "").ToLower()).Trim();
empDetail.Email = empDetail.Email.ToLower().Trim();
empDetail.UpdateDate = DateTime.Now;
empDetail.CreatedBy = 234;
empDetail.CreateDate = DateTime.Now;
empDetail.UpdatedBy = 234;
empDetail.Status = 1;
if (ModelState.IsValid)
{
db.EmpDetails.Add(empDetail);
db.SaveChanges();
return Json(1);
}
else
{
return Json(2);
}
}
catch (Exception e)
{
return Json(e.Message);
}
}
This is happening because the data is being sent via JSON instead of HTML Form data. You should try to pass the token in the headers. For example:
View:
<script>
#functions{
public string TokenHeaderValue()
{
string cookieToken, formToken;
AntiForgery.GetTokens(null, out cookieToken, out formToken);
return cookieToken + ":" + formToken;
}
}
$.ajax("api/values", {
type: "post",
contentType: "application/json",
data: { }, // JSON data goes here
dataType: "json",
headers: {
'RequestVerificationToken': '#TokenHeaderValue()'
}
});
</script>
Controller:
void ValidateRequestHeader(HttpRequestMessage request)
{
string cookieToken = "";
string formToken = "";
IEnumerable<string> tokenHeaders;
if (request.Headers.TryGetValues("RequestVerificationToken", out tokenHeaders))
{
string[] tokens = tokenHeaders.First().Split(':');
if (tokens.Length == 2)
{
cookieToken = tokens[0].Trim();
formToken = tokens[1].Trim();
}
}
AntiForgery.Validate(cookieToken, formToken);
}
Source: https://www.asp.net/web-api/overview/security/preventing-cross-site-request-forgery-csrf-attacks
A public action method 'AddPromoCode' was not found on controller
'Flazingo.Controllers.PositionController'. at
System.Web.Mvc.Controller.HandleUnknownAction(String actionName) at
System.Web.Mvc.Controller.ExecuteCore() at
System.Web.Mvc.ControllerBase.Execute(RequestContext requestContext)
at
System.Web.Mvc.MvcHandler.<>c__DisplayClass6.<>c__DisplayClassb.b__5()
at System.Web.Mvc.Async.AsyncResultWrapper.<>c__DisplayClass1.b__0()
at System.Web.Mvc.MvcHandler.<>c__DisplayClasse.b__d() at
System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
at System.Web.HttpApplication.ExecuteStep(IExecutionStep step,
Boolean& completedSynchronously)
Here is the ajax call:
$.ajax({
url: '/Position/AddPromoCode',
type: 'POST',
dataType: "json",
contentType: "application/json; charset:utf-8",
data: ko.toJSON(viewModel),
success: function(result){
if(result.TypeId == 1){
viewModel.promoOff(viewModel.grandTotal() * (result.Value / 100));
viewModel.PromoCodes.push(promoCode + ": "+ result.Value + "% off");
}else{
viewModel.PromoCodes.push(promoCode + ": "+ result.Value + "days free");
}
},
error: function (xmlHttpRequest, textStatus, errorThrown) {
var errorData = jQuery.parseJSON(xmlHttpRequest.responseText);
var errorMessages = [];
//this ugly loop is because List<> is serialized to an object instead of an array
for (var key in errorData)
{
errorMessages.push(errorData[key]);
}
toastr.error(errorMessages.join("<br />"), 'Uh oh');
}
});
EDIT: POST METHOD
[HttpPost]
public ActionResult AddPromoCode(PaymentViewModel model)
{
List<string> errors = new List<string>();
try
{
var position = db.Positions.SingleOrDefault(x => x.PositionId == model.PositionId);
if (position != null)
{
var promo = db.Promotions.SingleOrDefault(x => x.Code.ToLower() == model.PromoCode.ToLower() && x.IsUserEntered);
if (promo != null)
{
var promoUsage = db.PromoCodeUsages.SingleOrDefault(x => x.PromotionId == promo.PromotionId && x.ClientId == position.Client.Id);
int used = 0;
if (promoUsage != null)
{
used = promoUsage.Used;
}
if (used < promo.QuantityUsage)
{
if (DateTime.Today >= promo.StartDate && DateTime.Today <= promo.EndDate)
{
position.PromoCodes.Add(new PositionPromoCode
{
PromotionId = promo.PromotionId
});
var clientPC = position.Client.PromoCodes.SingleOrDefault(x => x.PromotionId == promo.PromotionId);
if (clientPC != null)
{
clientPC.Used = used + 1;
}
else
{
clientPC = new PromoCodeUsage()
{
PromotionId = promo.PromotionId,
Used = used + 1
};
position.Client.PromoCodes.Add(clientPC);
}
db.SaveChanges();
Response.StatusCode = (int)HttpStatusCode.OK;
return Json(new { Value = promo.Value, TypeId = promo.PromotionTypeId });
}
else
{
Response.StatusCode = (int)HttpStatusCode.BadRequest;
errors.Add("Sorry seems like this promotion code has expired");
db.SaveChanges();
return Json(errors);
}
}
else
{
Response.StatusCode = (int)HttpStatusCode.BadRequest;
errors.Add("Sorry seems like you have already used this code, or its not applicable anymore!");
db.SaveChanges();
return Json(errors);
}
}
else
{
Response.StatusCode = (int)HttpStatusCode.BadRequest;
errors.Add(string.Format("Sorry we don't have '{0}' promocode in our system!", model.PromoCode));
db.SaveChanges();
return Json(errors);
}
}
Response.StatusCode = (int)HttpStatusCode.BadRequest;
errors.Add("We coudn't find this position in our system!");
db.SaveChanges();
return Json(errors);
}
catch (Exception ex)
{
logger.Log(LogLevel.Error, string.Format("{0} \n {1}", ex.Message, ex.StackTrace));
Response.StatusCode = (int)HttpStatusCode.BadRequest;
errors.Add("Sorry there was internal errors, flazingo.com has been notified.");
return Json(errors);
}
}
JSON Structure:
{"PositionTitle":"Testing B Syntax Error","PromoCode":"FREECB","FirstName":null,"LastName":null,"Address":null,"SuiteNumber":null,"PhoneNumber":null,"City":null,"State":null,"ZipCode":null,"CreditCardNumber":null,"ExperationMonth":null,"ExperationYear":null,"CCV":null,"ClientId":2,"CustomerProfileId":64277420,"PositionId":78,"EmailAddress":"jmogera#gmail.com","Years":[{"Selected":false,"Text":"2013","Value":"2013"},{"Selected":false,"Text":"2014","Value":"2014"},{"Selected":false,"Text":"2015","Value":"2015"},{"Selected":false,"Text":"2016","Value":"2016"},{"Selected":false,"Text":"2017","Value":"2017"},{"Selected":false,"Text":"2018","Value":"2018"},{"Selected":false,"Text":"2019","Value":"2019"},{"Selected":false,"Text":"2020","Value":"2020"},{"Selected":false,"Text":"2021","Value":"2021"},{"Selected":false,"Text":"2022","Value":"2022"}],"MonthList":[{"Selected":false,"Text":"Jan","Value":"01"},{"Selected":false,"Text":"Feb","Value":"02"},{"Selected":false,"Text":"Mar","Value":"03"},{"Selected":false,"Text":"Apr","Value":"04"},{"Selected":false,"Text":"May","Value":"05"},{"Selected":false,"Text":"Jun","Value":"06"},{"Selected":false,"Text":"Jul","Value":"07"},{"Selected":false,"Text":"Aug","Value":"08"},{"Selected":false,"Text":"Sep","Value":"09"},{"Selected":false,"Text":"Oct","Value":"10"},{"Selected":false,"Text":"Nov","Value":"11"},{"Selected":false,"Text":"Dec","Value":"12"}],"IsAddingNewCard":false,"HaveCardOnFile":true,"AddOns":[{"PositionId":78,"ProductId":2,"Description":"The heart and soul, we take you through the hiring process, start to finish and give you every tool you need to make a great hire along the way.","Price":39,"HasAdded":true,"AutoRenew":true,"Name":"Complete Hiring System","AddOnId":122}],"CreditCards":[{"CreditCardId":16,"LastFour":"1060","HolderName":"Barrett Kuethen","ExpDate":"/Date(1422766800000)/","IsDefault":true}],"CardOnFile":{"CreditCardId":16,"LastFour":"1060","HolderName":"Barrett Kuethen","ExpDate":"/Date(1422766800000)/","IsDefault":true},"PromoCodes":[],"__ko_mapping__":{"CardOnFile":{},"ignore":[],"include":["_destroy"],"copy":[],"observe":[],"mappedProperties":{"PositionTitle":true,"PromoCode":true,"FirstName":true,"LastName":true,"Address":true,"SuiteNumber":true,"PhoneNumber":true,"City":true,"State":true,"ZipCode":true,"CreditCardNumber":true,"ExperationMonth":true,"ExperationYear":true,"CCV":true,"ClientId":true,"CustomerProfileId":true,"PositionId":true,"EmailAddress":true,"Years[0].Selected":true,"Years[0].Text":true,"Years[0].Value":true,"Years[1].Selected":true,"Years[1].Text":true,"Years[1].Value":true,"Years[2].Selected":true,"Years[2].Text":true,"Years[2].Value":true,"Years[3].Selected":true,"Years[3].Text":true,"Years[3].Value":true,"Years[4].Selected":true,"Years[4].Text":true,"Years[4].Value":true,"Years[5].Selected":true,"Years[5].Text":true,"Years[5].Value":true,"Years[6].Selected":true,"Years[6].Text":true,"Years[6].Value":true,"Years[7].Selected":true,"Years[7].Text":true,"Years[7].Value":true,"Years[8].Selected":true,"Years[8].Text":true,"Years[8].Value":true,"Years[9].Selected":true,"Years[9].Text":true,"Years[9].Value":true,"Years":true,"MonthList[0].Selected":true,"MonthList[0].Text":true,"MonthList[0].Value":true,"MonthList[1].Selected":true,"MonthList[1].Text":true,"MonthList[1].Value":true,"MonthList[2].Selected":true,"MonthList[2].Text":true,"MonthList[2].Value":true,"MonthList[3].Selected":true,"MonthList[3].Text":true,"MonthList[3].Value":true,"MonthList[4].Selected":true,"MonthList[4].Text":true,"MonthList[4].Value":true,"MonthList[5].Selected":true,"MonthList[5].Text":true,"MonthList[5].Value":true,"MonthList[6].Selected":true,"MonthList[6].Text":true,"MonthList[6].Value":true,"MonthList[7].Selected":true,"MonthList[7].Text":true,"MonthList[7].Value":true,"MonthList[8].Selected":true,"MonthList[8].Text":true,"MonthList[8].Value":true,"MonthList[9].Selected":true,"MonthList[9].Text":true,"MonthList[9].Value":true,"MonthList[10].Selected":true,"MonthList[10].Text":true,"MonthList[10].Value":true,"MonthList[11].Selected":true,"MonthList[11].Text":true,"MonthList[11].Value":true,"MonthList":true,"IsAddingNewCard":true,"HaveCardOnFile":true,"AddOns[0].PositionId":true,"AddOns[0].ProductId":true,"AddOns[0].Description":true,"AddOns[0].Price":true,"AddOns[0].HasAdded":true,"AddOns[0].AutoRenew":true,"AddOns[0].Name":true,"AddOns[0].AddOnId":true,"AddOns":true,"CreditCards[0].CreditCardId":true,"CreditCards[0].LastFour":true,"CreditCards[0].HolderName":true,"CreditCards[0].ExpDate":true,"CreditCards[0].IsDefault":true,"CreditCards":true,"CardOnFile":true,"PromoCodes":true},"copiedProperties":{}},"addNewCreditCardValidationGroup":{"FirstName":null,"LastName":null,"Address":null,"City":null,"State":null,"CreditCardNumber":null,"ExperationMonth":null,"ExperationYear":null,"CCV":null,"errors":[]},"promoOff":0,"grandTotal":39}
Note: the call is made within a knockout click function.
Note: I have created another issue, thinking it was client side issue. This is related.
Uncaught SyntaxError: Unexpected token B on live but not local server
It can't find AddPromoCode so, there seems a url problem. You should add the application name at ajax code in server like url: '/ApplicationName/Position/AddPromoCode'.
You can also do this with url.action html helper, like:
// In layout or view:
#Html.Hidden("urlPrefix", Url.Action("", ""))
// In Javascript
var baseUrl = $("input#urlPrefix").val();
$.ajax({ url: baseUrl + '/Position/AddPromoCode', ...
The part Url.Action("", "") creates '/ApplicationName' part dynamically.