I’m writing a C# Module for DotNetNuke 9.13 and I’m having issues with the AntiForgeryToken.
When I decorate the post method with [HttpPost] and [DotNetNuke.Web.Mvc.Framework.ActionFilters.ValidateAntiForgeryToken] I get an HTTP 401 error when I submit my form.
If I remove the [DotNetNuke.Web.Mvc.Framework.ActionFilters.ValidateAntiForgeryToken] attribute then it works.
When I check the page source BEFORE I click the submit button, I can see that the __RequestVerificationToken field inside the form, but when the form is posted, it is not present in the payload being sent (viewed using Fiddler).

There’s nothing special with my cshtml form – the main body of it is this:

                <div id="PaymentDetails" class="paymentDetails">
                    @*                    @{ Html.EnableClientValidation(true); }*@
                    <div>
                        <label>@Dnn.LocalizeString("lblPaymentReference") *</label>
                        @Html.TextBoxFor(m => m.Details.Reference)
                        <span>@Dnn.LocalizeString("lblPaymentReferenceExplanation")</span>
                        @Html.ValidationMessageFor(m => m.Details.Reference, @Dnn.LocalizeString("ReferenceRequired"))
                    </div>
                    <div>
                        <label>@Dnn.LocalizeString("lblPaymentAmount") *</label>
                        @Html.TextBoxFor(m => m.Details.Amount, "{0:c}")
                        @Html.ValidationMessageFor(m => m.Details.Amount, @Dnn.LocalizeString("AmountRequired"))
                    </div>
                    <div>
                        <label>@Dnn.LocalizeString("lblPaidBy") *</label>
                        @Html.DropDownListFor(m => m.Details.PaidByUserId, Model.Contacts, "Paid by", new { required = "required" })
                        @Html.ValidationMessageFor(m => m.Details.PaidByUserId, @Dnn.LocalizeString("PaidByContactRequired"))
                    </div>
                </div>
                <div id="Actions" class="margins-tlr-15 padded">
                    <button type="submit" class="dnnPrimaryAction">@Dnn.LocalizeString("Submit")</button>
                </div>

My controller has the following method:

        [HttpPost]
        [DotNetNuke.Web.Mvc.Framework.ActionFilters.ValidateAntiForgeryToken]
        public ActionResult ManualPayment(DtoMakePayment makePayment)
        {
            return RedirectToDefaultRoute();
        }

When I remove the [DotNetNuke.Web.Mvc.Framework.ActionFilters.ValidateAntiForgeryToken] attribute – then my form posts correctly.

I’ve looked at the Dnn.ContactList.Mvc sample module – it looks to be implemented the same as what I have, except that my code is not working.

Any help would be greatly appreciated.

Thanx,
Alon