Html.AntiForgeryToken - IIS classic pipeline incompatibility

[ParanoidPenguin]

I tried upgrading an old app from Microsoft.AspNet.Mvc 5.2.3 to 5.2.6 earlier today and encountered a System.PlatformNotSupportedException when calling Html.AntiForgeryToken(). "This operation requires IIS integrated pipeline mode".

This app is currently using Classic mode on a 2012 r2 server. Afraid the system is awkward to access for debugging/diagnostic etc (offline, remote site) so at the time I just had to just rollback to 5.2.3 (which works fine). Apologies I don't have more detailed info or a stack trace.

Thought I'd mention it in case it affects anyone. I guess this might have been introduced during the 5.2.4 change (Html.AntiForgeryToken() adds duplicate X-Frame-Options headers if called more than once) but I can't be certain.

[dougbu]

@ParanoidPenguin thanks for reporting the issue. Any more information would be much appreciated.

In the meantime, I'll look at the details of the 5.2.4 release for anything overlapping the symptoms you describe.

[icnocop]

I encountered this issue too when I updated the Microsoft.AspNet.Mvc NuGet package from 5.2.3 to 5.2.4.

Here's a copy of the YSOD from Windows Server 2016:
This operation requires IIS integrated pipeline mode.txt

Login.cshtml snippet:

@using (Html.BeginForm("Login", "Account", new { ReturnUrl = ViewBag.ReturnUrl }, FormMethod.Post, new { @class = "form-horizontal", role = "form" }))
{
    @Html.AntiForgeryToken() // Line 13
    <hr />
    @Html.ValidationSummary(true, "", new { @class = "text-danger" })

Stack Trace:

[PlatformNotSupportedException: This operation requires IIS integrated pipeline mode.]
   System.Web.HttpResponse.get_Headers() +174
   System.Web.HttpResponseWrapper.get_Headers() +10
   System.Web.Helpers.AntiXsrf.AntiForgeryWorker.GetFormInputElement(HttpContextBase httpContext) +112
   System.Web.Helpers.AntiForgery.GetHtml() +92
   System.Web.Mvc.HtmlHelper.AntiForgeryToken() +21
   ASP._Page_Views_Account_Login_cshtml.Execute() in c:\Program Files (x86)\Company\Application\WebRoot\Web\Views\Account\Login.cshtml:13
   System.Web.WebPages.WebPageBase.ExecutePageHierarchy() +197
   System.Web.Mvc.WebViewPage.ExecutePageHierarchy() +105
   System.Web.WebPages.StartPage.RunPage() +17
   System.Web.WebPages.StartPage.ExecutePageHierarchy() +73
   System.Web.WebPages.WebPageBase.ExecutePageHierarchy(WebPageContext pageContext, TextWriter writer, WebPageRenderingBase startPage) +78
   System.Web.Mvc.RazorView.RenderView(ViewContext viewContext, TextWriter writer, Object instance) +235
   System.Web.Mvc.BuildManagerCompiledView.Render(ViewContext viewContext, TextWriter writer) +107
   System.Web.Mvc.ViewResultBase.ExecuteResult(ControllerContext context) +291
   System.Web.Mvc.ControllerActionInvoker.InvokeActionResult(ControllerContext controllerContext, ActionResult actionResult) +13
   System.Web.Mvc.ControllerActionInvoker.InvokeActionResultFilterRecursive(IList`1 filters, Int32 filterIndex, ResultExecutingContext preContext, ControllerContext controllerContext, ActionResult actionResult) +56
   System.Web.Mvc.ControllerActionInvoker.InvokeActionResultFilterRecursive(IList`1 filters, Int32 filterIndex, ResultExecutingContext preContext, ControllerContext controllerContext, ActionResult actionResult) +420
   System.Web.Mvc.ControllerActionInvoker.InvokeActionResultWithFilters(ControllerContext controllerContext, IList`1 filters, ActionResult actionResult) +52
   System.Web.Mvc.Async.<>c__DisplayClass3_6.<BeginInvokeAction>b__3() +197
   System.Web.Mvc.Async.<>c__DisplayClass3_1.<BeginInvokeAction>b__5(IAsyncResult asyncResult) +100
   System.Web.Mvc.Async.WrappedAsyncResult`1.CallEndDelegate(IAsyncResult asyncResult) +10
   System.Web.Mvc.Async.WrappedAsyncResultBase`1.End() +49
   System.Web.Mvc.Async.AsyncControllerActionInvoker.EndInvokeAction(IAsyncResult asyncResult) +27
   System.Web.Mvc.<>c.<BeginExecuteCore>b__152_1(IAsyncResult asyncResult, ExecuteCoreState innerState) +11
   System.Web.Mvc.Async.WrappedAsyncVoid`1.CallEndDelegate(IAsyncResult asyncResult) +29
   System.Web.Mvc.Async.WrappedAsyncResultBase`1.End() +49
   System.Web.Mvc.Controller.EndExecuteCore(IAsyncResult asyncResult) +45
   System.Web.Mvc.<>c.<BeginExecute>b__151_2(IAsyncResult asyncResult, Controller controller) +13
   System.Web.Mvc.Async.WrappedAsyncVoid`1.CallEndDelegate(IAsyncResult asyncResult) +22
   System.Web.Mvc.Async.WrappedAsyncResultBase`1.End() +49
   System.Web.Mvc.Controller.EndExecute(IAsyncResult asyncResult) +26
   System.Web.Mvc.Controller.System.Web.Mvc.Async.IAsyncController.EndExecute(IAsyncResult asyncResult) +10
   System.Web.Mvc.<>c.<BeginProcessRequest>b__20_1(IAsyncResult asyncResult, ProcessRequestState innerState) +28
   System.Web.Mvc.Async.WrappedAsyncVoid`1.CallEndDelegate(IAsyncResult asyncResult) +29
   System.Web.Mvc.Async.WrappedAsyncResultBase`1.End() +49
   System.Web.Mvc.MvcHandler.EndProcessRequest(IAsyncResult asyncResult) +28
   System.Web.Mvc.MvcHandler.System.Web.IHttpAsyncHandler.EndProcessRequest(IAsyncResult result) +9
   System.Web.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +549
   System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +157

Thank you.

Edit
I was still receiving the error even after downgrading the Microsoft.AspNet.Mvc NuGet package from 5.2.4 back to 5.2.3, and was only able to get it working again when I also downgraded the Microsoft.AspNet.Razor and Microsoft.AspNet.WebPages NuGet packages from 3.2.4 back to 3.2.3.

[dougbu]

@icnocop thank-you for the additional information

[icnocop]

Here's a work-around:

In Global.asax.cs:

1. Set AntiForgeryConfig.SuppressXFrameOptionsHeader = true; in Application_Start:

protected void Application_Start()
{
    // other code here, removed for brevity

    AntiForgeryConfig.SuppressXFrameOptionsHeader = true;
}

2. Manually add the X-Frame-Options header in Application_BeginRequest:

protected void Application_BeginRequest(object sender, EventArgs e)
{
    HttpContext.Current.Response.AddHeader("X-Frame-Options", "SAMEORIGIN");
}

[mkArtakMSFT]

Thanks for sharing the workaround, @icnocop.
Closing as we don't plan to do more here.