I am using asp.net application and I dont know how to implement and validate CSRF tokens in asp.net.I want to validate these tokens in each request.
Can anyone help me?
And I have added this following code in Masterpage
- private const string AntiXsrfTokenKey = "__AntiXsrfToken";    
- private const string AntiXsrfUserNameKey = "__AntiXsrfUserName";    
- private string _antiXsrfTokenValue;      
- protected void Page_Init(object sender, EventArgs e) {    
-  var requestCookie = Request.Cookies[AntiXsrfTokenKey];    
-  Guid requestCookieGuidValue;    
-  if (requestCookie != null && Guid.TryParse(requestCookie.Value, out requestCookieGuidValue)) {    
-   _antiXsrfTokenValue = requestCookie.Value;    
-   Page.ViewStateUserKey = _antiXsrfTokenValue;    
-     
-  } else {    
-   _antiXsrfTokenValue = Guid.NewGuid().ToString("N");    
-   Page.ViewStateUserKey = _antiXsrfTokenValue;    
-   var responseCookie = new HttpCookie(AntiXsrfTokenKey) {    
-    HttpOnly = true,    
-     Value = _antiXsrfTokenValue    
-   };    
-   if (FormsAuthentication.RequireSSL && Request.IsSecureConnection) {    
-    responseCookie.Secure = true;    
-   }    
-   Response.Cookies.Set(responseCookie);    
-  }    
-     
-  Page.PreLoad += master_Page_PreLoad;    
- }    
-     
- protected void master_Page_PreLoad(object sender, EventArgs e) {    
-  try {    
-   if (!IsPostBack) {    
-    ViewState[AntiXsrfTokenKey] = Page.ViewStateUserKey;    
-    ViewState[AntiXsrfUserNameKey] = Context.User.Identity.Name ? ? String.Empty;    
-   } else {    
-      
-    if ((string) ViewState[AntiXsrfTokenKey] != _antiXsrfTokenValue || (string) ViewState[AntiXsrfUserNameKey] != (Context.User.Identity.Name ? ? String.Empty)) {    
-     throw new InvalidOperationException("Validation of " + "Anti-XSRF token failed.");    
-    }    
-   }    
-  } catch (Exception ex) {    
-   activityLog.Write("MasterPage->PageLoad->Exception->" + ex.Message.ToString());    
-   Session.Clear();    
-   Session.RemoveAll();    
-   Session.Abandon();    
-   Response.Cookies["ASP.NET_SessionId"].Expires = DateTime.Now.AddYears(-30);    
-   Response.Cookies.Add(new HttpCookie("ASP.NET_SessionId", ""));    
-   ScriptManager.RegisterStartupScript(this, GetType(), "DeleteCookie", "DeleteCookie();", true);    
-   Response.Redirect("Default.aspx", false);    
-  }    
- }