经过一番寻找，我找到了一个简单的解决方案。首先创建控制器，并使用HttpPost和ValidateAntiForgeryToken装饰它

string uriBase = Environment.GetEnvironmentVariable("UriBaseWorkdayAbsenceManagement");
        string user = Environment.GetEnvironmentVariable("WorkdayUsername");
        string pass = Environment.GetEnvironmentVariable("WorkdayPassword");

        string xml;
        XmlWriterSettings settings = new XmlWriterSettings();
        settings.OmitXmlDeclaration = true;
        using (MemoryStream ms = new MemoryStream())
        {
            using (XmlWriter writer = XmlWriter.Create(ms,settings))
            {
                XmlSerializerNamespaces names = new XmlSerializerNamespaces();
                names.Add("soapenv","http://schemas.xmlsoap.org/soap/envelope/");
                names.Add("bsvc","urn:com.workday/bsvc");
                XmlSerializer cs = new XmlSerializer(typeof(Envelope));
                var myEnv = new Envelope()
                {
                    Header = new EnvelopeHeader()
                    {
                        Security = new Security()
                        {
                            UsernameToken = new SecurityUsernameToken()
                            {
                                Username = user,Password = new SecurityUsernameTokenPassword()
                                {
                                    Type = "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText",//update type to match your case
                                    Value = pass
                                }
                            }
                        }
                    },Body = new EnvelopeBody()
                    {
                        get_Time_Off_Plan_Balances_RequestType = new WorkDayAbsenceServiceReference.Get_Time_Off_Plan_Balances_RequestType()
                        {
                            Request_Criteria = new WorkDayAbsenceServiceReference.Time_Off_Plan_Balance_Request_CriteriaType()
                            {
                                Employee_Reference = new WorkDayAbsenceServiceReference.WorkerObjectType()
                                {
                                    ID = new WorkDayAbsenceServiceReference.WorkerObjectIDType[]
                                    {
                                        new WorkDayAbsenceServiceReference.WorkerObjectIDType
                                        {
                                            type = "Employee_ID",Value = workerId
                                        }
                                    }
                                }
                            }
                        }
                    }
                };


                cs.Serialize(writer,myEnv,names);
                ms.Flush();
                ms.Seek(0,SeekOrigin.Begin);
                StreamReader sr = new StreamReader(ms);
                xml = sr.ReadToEnd();
            }
        }

        SoapEnvelope responseEnvelope = null;
        using (var client = SoapClient.Prepare().WithHandler(new DelegatingSoapHandler()
        {
            OnHttpRequestAsyncAction = async (z,x,y) =>
            {
                x.Request.Content = new StringContent(xml,Encoding.UTF8,"text/xml");
            }
        }))
        {
            responseEnvelope = client.SendAsync(uriBase,"action",SoapEnvelope.Prepare()).Result;
        }

然后在使用axios调用控制器之前，为标头添加以下拦截器。这会将标头定义为所有axios api调用的默认标头

[HttpPost]
[ValidateAntiForgeryToken]
public void Test_Axios(int id) { }

然后取回令牌

axios.defaults.headers.common['X-Requested-With'] = 'XMLHttpRequest';

然后使用qs库对带有令牌的呼叫进行字符串化处理（请注意！它是Qs，而不是qs！）

var token = document.querySelector('token,input').getAttribute('value');

如果您不想传递任何参数，则可以使用以下内容

var request = Qs.stringify({ id: 22,__RequestVerificationToken: token });

然后只需调用控制器方法

var request = Qs.stringify({ __RequestVerificationToken: token });

您完成了！现在，您可以开始调用装饰有[ValidateAntiForgeryToken]属性的mvc 5控制器。