The ValidateCsrf configuration was always true, regardless of the value at appsettings.json or web.config.

Author: claudiamurialdo

dotnet/src/dotnetframework/GxClasses/Core/gxconfig.cs

@@ -795,7 +795,7 @@ public class Preferences
 		const string USE_NAMED_PARAMETERS = "UseNamedParameters";
 		const string REST_DATES_WITH_MILLIS = "REST_DATES_WITH_MILLIS";
 		internal const string YES = "1";
-		const string NO = "0";
+		internal const string NO = "0";
 		static string defaultDatastore;
 		const string DEFAULT_DS = "Default";
 		static int httpclient_max_per_route = -1;

dotnet/src/dotnetframework/GxClasses/Helpers/GXRestUtils.cs

@@ -142,7 +142,7 @@ public static Dictionary<string, object> ReadRestBodyParameters(Stream stream)
 
 		internal static bool ValidateCsrfToken()
 		{
-			return Config.GetValueOf("ValidateCSRF", Preferences.YES) == Preferences.YES;
+			return Config.GetValueOf("ValidateCSRF", Preferences.NO) == Preferences.YES;
 		}
 	}
 }