How To Secure Your Request With AntiForgeryToken

• Use Html Helper
  @Html.AntiForgeryToken() in the forms in views
  
  This method will create the token which is like the secret code and then put it in as a hidden field in the form and also as the cookie on user’s computer. Now let’s see this cookie in action.
  
  
  
  
  It is called request verification token. Look at the value -- it is the long weird string. This value is also stored on the user’s computer as a cookie in an encrypted format. So we can see this cookie in the browser as well.
  
  
  

So we give the user a token and when he posted the form, we get these two values.

• Hidden Fields
• Encrypted Cookie

And compare that, if they match that means it is the legitimate request otherwise it’s an attack. Because if the attacker redirects the user to the malicious page, they don’t have access to the hidden fields of the form. Because these hidden fields only exist when the user actually visits our Student form.

Even if the hacker steals the cookie, he still doesn’t have access to the hidden fields. So on the server, we do this validation if these values don’t match, it’s an attack and we immediately stop the request.

• Now to perform the validation, we decorate our action with [ValidateAntiForgeryToken] attribute. So all the complexity of generating the token encrypting it validating it is done by MVC Framework, we don’t have to worry about it. We just have to remember to apply these attributes to our action and use the HTML helper method in post forms views.
  
  1. [HttpPost]
  2. [ValidateAntiForgeryToken]
  3. public ActionResult Create([Bind(Include = "Id,Name,Email,RetypeEmail,Phone,Cnic,Age,City,Address,DateOfBirth")] Student student) {
  4. if (ModelState.IsValid) {
  5. db.Students.Add(student);
  6. db.SaveChanges();
  7. return RedirectToAction("Index");
  8. }
  9. return View(student);
  10. }

Now build the application and test again. Let’s suppose we want to test again our application. Fill the form with data and remove the token from the views and submit the request.

Now if he submits the form, then the error will pop up. And this is how this item works.

And this is how we prevent from CSRF or XSRF attack.

Conclusion

Today, we’ve discussed how to use AntiForgeryToken and how it is helpful, and how it works under the hood. And we learned the lesson that if you’re developing online banking, transaction system, then you need to keep in mind some important tips and tricks of ASP.NET MVC to make the application more robust and secure.