<\/div>\n
Merhaba,<\/p>\n
Bu i\u00e7eri\u011fimizde .NET 8 ile Asp.NET Core mimarisinde minimal api’ler de form binding’e y\u00f6nelik gelen yenili\u011fe dair odaklanacak ve bu destekle birlikte form kullan\u0131m\u0131 a\u00e7\u0131s\u0131ndan MVC controller’lar\u0131na olan ba\u011f\u0131ml\u0131l\u0131\u011f\u0131n ortadan kald\u0131r\u0131lmas\u0131 temellerinin nas\u0131l at\u0131ld\u0131\u011f\u0131n\u0131 inceliyor olaca\u011f\u0131z.<\/p>\n
Malumunuz, minimal api’ler HTML ile \u00e7al\u0131\u015fmak i\u00e7in herhangi bir olanak sa\u011flamamakta ve odak noktas\u0131 olarak JSON t\u00fcr\u00fcnden verileri \u00fcretmek ve t\u00fcketmek \u00fczerine kurgulanmaktad\u0131r. Tabi bu \u015fartlarda minimal api’ler de illa HTML i\u00e7erikleri olu\u015fturmak istiyor yahut b\u00f6yle bir ihtiya\u00e7 do\u011frultusunda hareket etmeniz gerekiyorsa i\u015fte bu taktirde a\u015fa\u011f\u0131daki gibi bir string tan\u0131mlamas\u0131yla ihtiyac\u0131n\u0131z\u0131 giderebilirsiniz.<\/p>\n
\r\nusing System.Net.Mime;\r\n\r\nvar builder = WebApplication.CreateBuilder(args);\r\n\r\nvar app = builder.Build();\r\n\r\napp.MapGet("\/", () =>\r\n{\r\n    string html = """\r\n                  <!DOCTYPE html>\r\n                  <html>\r\n                      <head>\r\n                        <title>Page Title<\/title>\r\n                      <\/head>\r\n                  <body>\r\n                      <h1>This is a Heading<\/h1>\r\n                      <p>This is a paragraph.<\/p>\r\n                  <\/body>\r\n                  <\/html>\r\n                  """;\r\n\r\n    return Results.Content(html, MediaTypeNames.Text.Html);\r\n});\r\n\r\napp.Run();\r\n\r\n<\/pre>\n<\/div>\nAmma velakin gelin g\u00f6r\u00fcn ki, minimal api’ler de POST edilmi\u015f olan form verilerini yakalamak(bind olmak) .NET 7 ve \u00f6ncesinde pek m\u00fcmk\u00fcn de\u011fildir. Evet, post edilmi\u015f olan form verilerini Razor Page ve controller’lar da rahatl\u0131kla kullanabilirken, minimal api’ler de kullanam\u0131yorduk. Tabi form’lardan gelecek olan multipart\/form-data<\/code> i\u00e7erik t\u00fcr\u00fcnden olan verileri IFormFile<\/code> referans\u0131yla bind edebiliyor ve hatta IFormFileCollection<\/code> referans\u0131yla da \u00e7o\u011ful olarak kar\u015f\u0131layabiliyorduk. Yani form binding yap\u0131lanmas\u0131 minimal api’ler a\u00e7\u0131s\u0131ndan k\u0131smen ge\u00e7erlilik g\u00f6steriyordu.<\/p>\n
Bunu hemen \u00f6rneklendirmemiz gerekirse e\u011fer;<\/p>\n
\n\r\nusing Microsoft.AspNetCore.Antiforgery;\r\nusing Microsoft.AspNetCore.Mvc;\r\nusing System.Net.Mime;\r\n\r\nvar builder = WebApplication.CreateBuilder(args);\r\nbuilder.Services.AddAntiforgery();\r\n\r\nvar app = builder.Build();\r\napp.UseAntiforgery();\r\n\r\napp.MapGet("\/", (IAntiforgery antiforgery, HttpContext context) =>\r\n{\r\n    var token = antiforgery.GetAndStoreTokens(context);\r\n    string html = $"""\r\n                      <form action="\/upload-file" method="post" enctype="multipart\/form-data">\r\n                          <input name="{token.FormFieldName}" type="hidden" value="{token.RequestToken}" \/>\r\n                          <input type="file" name="file">\r\n                          <input type="submit" value="G\u00f6nder">\r\n                      <\/form>\r\n                  """;\r\n\r\n    return Results.Content(html, MediaTypeNames.Text.Html, Encoding.UTF8);\r\n});\r\n\r\napp.MapPost("\/upload-file", async ([FromForm] IFormFile file) =>\r\n{\r\n    return TypedResults.Ok(file);\r\n});\r\n\r\napp.Run();\r\n<\/pre>\n<\/div>\nYukar\u0131daki kod blo\u011funu incelerseniz e\u011fer 11<\/em><\/strong> ile 23.<\/em><\/strong> sat\u0131r aral\u0131\u011f\u0131nda form yap\u0131s\u0131 olu\u015fturulurken bir yandan da CSRF\/XSRF(Cross-Site Request Forgery)<\/a> sald\u0131r\u0131lar\u0131na kar\u015f\u0131 Anti-forgery \u00f6nlemi al\u0131nmaktad\u0131r. Bunun nedeni form submit edildi\u011finde bunu kar\u015f\u0131layacak olan ‘upload-file’ endpoint’inin bu olas\u0131 sald\u0131r\u0131lardan korunmas\u0131 i\u00e7in Asp.NET Core mimarisi taraf\u0131ndan al\u0131nan varsay\u0131lan bir koruma mekanizmas\u0131d\u0131r. Dolay\u0131s\u0131yla burada Anti-forgery \u00f6nlemi i\u00e7in 6.<\/em><\/strong> sat\u0131rda AddAntiforgery<\/code> servisi eklenmekte ve 9.<\/em><\/strong> sat\u0131rda da endpoint’lere gelen isteklerde anti-forgery koruma kontrol\u00fcn\u00fcn yap\u0131labilmesi i\u00e7in UseAntiforgery<\/code> middleware’i \u00e7a\u011fr\u0131lmaktad\u0131r. Ard\u0131ndan yine 11<\/em><\/strong> ile 23.<\/em><\/strong> sat\u0131r aral\u0131\u011f\u0131nda IAntiforgery<\/code> aray\u00fcz\u00fcne kar\u015f\u0131l\u0131k instance IoC Container’dan dependency injection ile talep edilmekte ve gerekli g\u00fcvenlik token’\u0131 olu\u015fturulup form i\u00e7erisindeki 16.<\/em><\/strong> sat\u0131rdaki ‘hidden’ input’una verilmektedir. Tabi burada token.FormFieldName<\/code> komutu neticesinde ‘__RequestVerificationToken’<\/em> de\u011ferinin gelece\u011fini bilmenizde fayda vard\u0131r.<\/p>\n

\nAsp.NET Core mimarisinde varsay\u0131lan olarak aktif gelen Anti-forgery \u00f6nlemini kald\u0131rmak istiyorsan\u0131z a\u015fa\u011f\u0131daki gibi DisableAntiforgery()<\/code> metodunu kullanabilirsiniz.<\/p>\n
\n\r\napp.MapPost("\/upload-file", async ([FromForm] IFormFile file) =>\r\n{\r\n    return TypedResults.Ok(file);\r\n}).DisableAntiforgery();\r\n<\/pre>\n<\/div>\n<\/em><\/p><\/blockquote>\nVelhas\u0131l kelam, yap\u0131lan t\u00fcm bu \u00e7al\u0131\u015fmalar neticesinde taray\u0131c\u0131 \u00fczerinden form’u submit etti\u011fimizde dosya bilgileri ‘upload-file’ endpoint’inde elde edilecektir.<\/a>\u015eimdi bu \u00e7al\u0131\u015fma \u00fczerine a\u015fa\u011f\u0131daki gibi bir form’un da post edilmesinde herhangi bir sak\u0131nca g\u00f6r\u00fclmemektedir, \u00f6yle de\u011fil mi?<\/p>\n
\n\r\n<form action="\/upload-file" method="post" enctype="multipart\/form-data">\r\n    <input name="{token.FormFieldName}" type="hidden" value="{token.RequestToken}" \/>\r\n    <input type="file" name="file">\r\n    <input type="text" name="fileName">\r\n    <input type="text" name="description">\r\n    <input type="submit" value="G\u00f6nder">\r\n<\/form>\r\n<\/pre>\n<\/div>\nBu formdaki file d\u0131\u015f\u0131nda kalan ekstra verileri .NET 8 \u00f6ncesinde a\u015fa\u011f\u0131daki gibi elde edebiliyorduk;<\/p>\n
\n\r\napp.MapPost("\/upload-file", async ([FromForm] IFormFile file, HttpRequest request) =>\r\n{\r\n    IFormCollection formCollection = await request.ReadFormAsync();\r\n    var fileName = formCollection["fileName"];\r\n    var description = formCollection["description"];\r\n    return TypedResults.Ok(file);\r\n});\r\n<\/pre>\n<\/div>\n.NET 8 ile ise \u015f\u00f6yle elde edebiliyoruz;<\/p>\n
\n\r\napp.MapPost("\/upload-file", async ([FromForm] IFormFile file, [FromForm] string fileName, [FromForm] string description) =>\r\n{\r\n    return TypedResults.Ok(file);\r\n});\r\n<\/pre>\n<\/div>\nya da a\u015fa\u011f\u0131daki gibi complex type olarak da kar\u015f\u0131layabiliyoruz;<\/p>\n
\n\r\napp.MapPost("\/upload-file", async ([FromForm] UploadFileInfo model) =>\r\n{\r\n    return TypedResults.Ok(model);\r\n});\r\n<\/pre>\n<\/div>\n\n\r\n    public class UploadFileInfo\r\n    {\r\n        public IFormFile File { get; set; }\r\n        public string FileName { get; set; }\r\n        public string Description { get; set; }\r\n    }\r\n<\/pre>\n<\/div>\n.NET 8’den itibaren, IFormFile<\/code> ve IFormFileCollection<\/code> referanslar\u0131nda [FromForm]<\/code> attribute’unu uygulaman\u0131za gerek yoktur!<\/em><\/p><\/blockquote>\n
Nihai olarak,
\n.NET 8’de minimal api’ler i\u00e7in HTML form yap\u0131lanmalar\u0131na kar\u015f\u0131n binding mekanizmas\u0131n\u0131n \u015fekillendi\u011fini ve bunlar\u0131n d\u0131\u015f\u0131nda Anti-forgery \u00f6nlemine kar\u015f\u0131n gerekli \u00e7al\u0131\u015fmalar\u0131n nas\u0131l yap\u0131labilece\u011fini incelemi\u015f olduk.<\/p>\n
\u0130lgilenenlerin faydalanmas\u0131 dile\u011fiyle…
\nSonraki yaz\u0131lar\u0131mda g\u00f6r\u00fc\u015fmek \u00fczere…
\n\u0130yi \u00e7al\u0131\u015fmalar…<\/p>\n","protected":false},"excerpt":{"rendered":"
Merhaba, Bu i\u00e7eri\u011fimizde .NET 8 ile Asp.NET Core mimarisinde minimal api’ler de form binding’e y\u00f6nelik gelen yenili\u011fe dair odaklanacak ve bu destekle birlikte form kullan\u0131m\u0131 a\u00e7\u0131s\u0131ndan MVC controller’lar\u0131na olan ba\u011f\u0131ml\u0131l\u0131\u011f\u0131n ortadan kald\u0131r\u0131lmas\u0131 temellerinin nas\u0131l...<\/p>\n","protected":false},"author":1,"featured_media":26539,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4912],"tags":[4915,4982,4930,4983],"class_list":["post-26770","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-net-8","tag-net-8","tag-form-binding","tag-minimal-api","tag-minimal-api-form-binding"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/26770","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/comments?post=26770"}],"version-history":[{"count":3,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/26770\/revisions"}],"predecessor-version":[{"id":26774,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/26770\/revisions\/26774"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/media\/26539"}],"wp:attachment":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/media?parent=26770"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/categories?post=26770"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/tags?post=26770"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}