Antiforgery Token

This demo posts to a CSRF-protected endpoint. Leave the token enabled for a normal upload, then switch it off to watch the server reject the request with a real validation error.

What you should see: uploads go to a CSRF-protected endpoint and succeed with a valid token attached. Every request — including chunks — carries the token, so an expired session fails here rather than silently storing the file.

Send Request Token Include X-XSRF-TOKEN

Current Demo Token

CfDJ8CSzRozsN8xFn4RbrXV3WodzUDBF4aWtunUceqO0qzQHbgaI1Yr-LUDtAwC8X5RzJMxfNHoJtocmO93hMF2gPI-ed9yRnZfWlCNj2tnEZqUXTNGz6bgf2TihM60ymmh_wP6KeOy3KIeRLiRh4m0LT4A

Ready. Upload with the token enabled, then disable it to trigger server-side CSRF validation.

CoreUpload.create('#antiforgery-uploader', {
 uploadUrl: '/demo/security/antiforgery-upload',
 buttonText: 'Upload with Antiforgery Protection',
 multiple: true,
 autoUpload: true,
 headers: function () {
 return sendToken.checked
 ? { 'X-XSRF-TOKEN': requestToken }
 : {};
 }
});