Antiforgery Token

This demo posts to a CSRF-protected endpoint. Leave the token enabled for a normal upload, then switch it off to watch the server reject the request with a real validation error.

What you should see: uploads go to a CSRF-protected endpoint and succeed with a valid token attached. Every request — including chunks — carries the token, so an expired session fails here rather than silently storing the file.

Send Request Token Include X-XSRF-TOKEN

Current Demo Token

CfDJ8CSzRozsN8xFn4RbrXV3Woc28gAEaUs5mn-OMQly9vP1G5u_G05UW3e2yhtSX_JmiUii4Bf9FR2WwxzNsm2rj7AgsUfgWvrrZsdFPhtqLf8bRfCMrJIB_z8OChnBbI3dkARfH1ajE8MkLab4LDHae3c

Ready. Upload with the token enabled, then disable it to trigger server-side CSRF validation.

CoreUpload.create('#antiforgery-uploader', {
 uploadUrl: '/demo/security/antiforgery-upload',
 buttonText: 'Upload with Antiforgery Protection',
 multiple: true,
 autoUpload: true,
 headers: function () {
 return sendToken.checked
 ? { 'X-XSRF-TOKEN': requestToken }
 : {};
 }
});