Antiforgery Token

This demo posts to a CSRF-protected endpoint. Leave the token enabled for a normal upload, then switch it off to watch the server reject the request with a real validation error.

What you should see: uploads go to a CSRF-protected endpoint and succeed with a valid token attached. Every request — including chunks — carries the token, so an expired session fails here rather than silently storing the file.

Send Request Token Include X-XSRF-TOKEN

Current Demo Token

CfDJ8CSzRozsN8xFn4RbrXV3Wod9MWCSqgfTLmHBtmUeDP7YWt3jQ8uR6qtBuTTLMOfd7w36mtaT5146QlgDVO9HjLUDW9DtMAJcQbgJl-RQ_bIWf0L8hfuE5dfSKHtrfWob9rO7nm1GQ19ANtd8Zzt5mUw

Ready. Upload with the token enabled, then disable it to trigger server-side CSRF validation.

CoreUpload.create('#antiforgery-uploader', {
 uploadUrl: '/demo/security/antiforgery-upload',
 buttonText: 'Upload with Antiforgery Protection',
 multiple: true,
 autoUpload: true,
 headers: function () {
 return sendToken.checked
 ? { 'X-XSRF-TOKEN': requestToken }
 : {};
 }
});