Here will learn what Cross- site Request forgery in ASP.NET MVC is and how to protect our ASP.NET MVC application from the CSRF.
Cross- site Request forgery is abbreviated as “CSRF”.
What is CSRF
CSRF is an attack in which a user logs in to a website like ABC.com and after login user opens other site called malicious site in another tab, then this malicious site sends request to (ABC.com) valid site using existing credential or existing session for attacking the site. Valid site( ABC.com) assumes that this coming request is a valid request or coming from a valid user, so it executes that request and site is hacked by the CSRF.
After recognizing this attack ,Microsoft provides an Attribute called “AntiForgeryToken”. It is very simple to use in our site ,just we need to add “@Html.AntiForgeryToken” in view with that we need to add this in controller also as a attribute [ValidateAntiForgeryToken] to validating this. Basically AntiForgeryToken is used in HTTPPost method.
Now we learn this with an example using ASP.NET MVC.
Go to visual studio and create a new project and select an ASP.NET MVC 4 Web Application and give the name for project ,in my case it is “CSRFInMVCApplication” after that click ok then a window will open from there select a template as “Basic” and view engine as “Rezor”.
After clicking ok it will create a project, After that right click on model folder and add a class name “CollageInfo.cs”, and write the following code to this class,
What is CSRF
CSRF is an attack in which a user logs in to a website like ABC.com and after login user opens other site called malicious site in another tab, then this malicious site sends request to (ABC.com) valid site using existing credential or existing session for attacking the site. Valid site( ABC.com) assumes that this coming request is a valid request or coming from a valid user, so it executes that request and site is hacked by the CSRF.
After recognizing this attack ,Microsoft provides an Attribute called “AntiForgeryToken”. It is very simple to use in our site ,just we need to add “@Html.AntiForgeryToken” in view with that we need to add this in controller also as a attribute [ValidateAntiForgeryToken] to validating this. Basically AntiForgeryToken is used in HTTPPost method.
Now we learn this with an example using ASP.NET MVC.
Go to visual studio and create a new project and select an ASP.NET MVC 4 Web Application and give the name for project ,in my case it is “CSRFInMVCApplication” after that click ok then a window will open from there select a template as “Basic” and view engine as “Rezor”.
After clicking ok it will create a project, After that right click on model folder and add a class name “CollageInfo.cs”, and write the following code to this class,
- public class CollageInfo
- {
- [Key]
- public int CollageID
- {
- get;
- set;
- }
- [Required(ErrorMessage = " please Enter Name")]
- public string CollageName
- {
- get;
- set;
- }
- [Required(ErrorMessage = "pleaes Enter Address")]
- public string CollageAddress
- {
- get;
- set;
- }
- [Required(ErrorMessage = "please Enter Department")]
- public string CollageDepartment
- {
- get;
- set;
- }
- }
After adding controller we need to add action method name “collageInfo” with [HttpGet] and [HttpPost]. So for that write the following code in controller collageInfo action method.
- [HttpGet]
- public ActionResult collageInfo()
- {
- return View();
- }
- [HttpPost]
- public ActionResult collageInfo(CollageInfo _clgInfo)
- {
- return View(_clgInfo);
- }
After clicking on add it will generate code for the view. Here's the code for view,
- @model CSRFInMVCApplication.Models.CollageInfo
- @{
- ViewBag.Title = "collageInfo";
- }
- <h2>collageInfo</h2>
- @using (Html.BeginForm()) {
- @Html.ValidationSummary(true)
- <fieldset>
- <legend>CollageInfo</legend>
- <div class="editor-label">
- @Html.LabelFor(model => model.CollageName)
- </div>
- <div class="editor-field">
- @Html.EditorFor(model => model.CollageName)
- @Html.ValidationMessageFor(model => model.CollageName)
- < /div>
- <div class="editor-label">
- @Html.LabelFor(model => model.CollageAddress)
- </div>
- <div class="editor-field">
- @Html.EditorFor(model => model.CollageAddress)
- @Html.ValidationMessageFor(model => model.CollageAddress)
- </div>
- <div class="editor-label">
- @Html.LabelFor(model => model.CollageDepartment)
- </div>
- <div class="editor-field">
- @Html.EditorFor(model => model.CollageDepartment)
- @Html.ValidationMessageFor(model => model.CollageDepartment)
- </div>
- <p>
- <input type="submit" value="Create" />
- </p>
- </fieldset>
- }
- <div>
- @Html.ActionLink("Back to List", "Index")
- </div>
- @section Scripts {
- @Scripts.Render("~/bundles/jqueryval")
- }
Sivaraj SPosted Jul 10, 2018, 5:24 AM
I am able to capture the request using postman and able to send the same request using postman and how to avoid that
Munesh SharmaPosted Jun 24, 2016, 11:46 AM
thank you
Ashish PrasadPosted Jun 24, 2016, 10:25 AM
Its working fine.... good job.
Humayun Kabir MamunPosted May 22, 2016, 7:55 AM
Nice...
Kuppurasu NagarajPosted May 17, 2016, 11:06 AM
Nice sharing..
Munesh SharmaPosted May 17, 2016, 12:36 AM
thank you all
Sonu ChaudharyPosted May 16, 2016, 3:30 PM
good one...
Debasis SahaPosted May 16, 2016, 1:01 AM
Nice one..
Bhavik PatelPosted May 15, 2016, 9:17 PM
Good one
Munesh SharmaPosted May 15, 2016, 1:01 PM
thank you all
Sandeep Singh ShekhawatPosted May 15, 2016, 12:59 PM
Good one ! Keep it up !
Omid NasriPosted May 15, 2016, 11:24 AM
Thx man.
Pankaj Kumar ChoudharyPosted May 15, 2016, 10:50 AM
Great Concept in simple words..........