Why Http Post in Orchard Core asp net core Web App returns bad request

Question

I'm using Orchard core in asp net core web app project. I have a controller with two simple get and post Apis. As I'm using OrchardCore the Startup.cs file has different config and I dont use services.AddControllers() in configureServices. Every thing is fine untill I'm using HttpGet. But when I want to have an Api with HttpPost postMan says badRequest. So I Added services.AddControllers() in Startup.cs and the post Api was fine in post Man but the orchard project says I have multipe Endpoints. I used services.AddMvc().AddNewtonsoftJson(), and every thing was fine but the admin page didn't load and had error as below:

InvalidOperationException: The view 'Index' was not found. The following locations were searched: /Areas/OrchardCore.AdminDashboard/Views/Dashboard/Index.cshtml /Areas/OrchardCore.AdminDashboard/Views/Shared/Index.cshtml /Views/Shared/Index.cshtml /Pages/Shared/Index.cshtml

I wold appreciate it if you can help me how to call Post Api. here is my code:

[HttpPost("post")]
    public Task<string> post()
    {
        return Task.FromResult("hiPost");
    }

    [HttpGet("get")]
    public Task<string> get()
    {
        return Task.FromResult("hiGet");
    }

and this is my startup.cs

 public class Startup
    {
        public Startup(IConfiguration configuration)
        {
            Configuration = configuration;
        }

        public IConfiguration Configuration { get; }
        public void ConfigureServices(IServiceCollection services)
        {
            //services.AddControllers();
            services.AddOrchardCms();
            services.AddMediatR(typeof(SelectedWebSiteBlogQueryHandler).Assembly);
            services.AddAutoMapper(typeof(Startup));
            services.AddCors();
            services.AddMvc().AddNewtonsoftJson();

        }

        public void Configure(IApplicationBuilder app, IHostEnvironment env)
        {
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
            }
            app.UseCors(o => o.AllowAnyOrigin().AllowAnyHeader().AllowAnyMethod());
            app.UseHttpsRedirection();
            app.UseStaticFiles();

            app.UseOrchardCore();
        }
    }

Answer 1

You are probably missing an IgnoreAntiForgeryToken attribute on your controller.

AntiForgery is enabled by default by OrchardCore

For an ApiController in OrchardCore I would expect to see the controller decorated as follows.

[ApiController]
[Authorize(AuthenticationSchemes = "Api"), IgnoreAntiforgeryToken, AllowAnonymous]

However this depends if you are using the OpenId module to authenticate with, or simply need to post to a normal controller, without an AuthenticationScheme

Depending on what you are actually posting from in real life, it may be better to supply an anti forgery token as part of your post.