how to use csrfguard in asp.net c#

Question

how to use csrfguard in asp.net c#.. please tell me proper code for this problem

Rohan Gupta · Answer

Another code is... private const string AntiXsrfTokenKey = "__AntiXsrfToken" ; private const string AntiXsrfUserNameKey = "__AntiXsrfUserName" ; private string _antiXsrfTokenValue; protected void Page_Init( object sender, EventArgs e) { //First, check for the existence of the Anti-XSS cookie var requestCookie = Request.Cookies[AntiXsrfTokenKey]; Guid requestCookieGuidValue; //If the CSRF cookie is found, parse the token from the cookie. //Then, set the global page variable and view state user //key. The global variable will be used to validate that it matches //in the view state form field in the Page.PreLoad method. if (requestCookie != null && Guid.TryParse(requestCookie.Value, out requestCookieGuidValue)) { //Set the global token variable so the cookie value can be //validated against the value in the view state form field in //the Page.PreLoad method. _antiXsrfTokenValue = requestCookie.Value; //Set the view state user key, which will be validated by the //framework during each request Page.ViewStateUserKey = _antiXsrfTokenValue; } //If the CSRF cookie is not found, then this is a new session. else { //Generate a new Anti-XSRF token _antiXsrfTokenValue = Guid.NewGuid().ToString( "N" ); //Set the view state user key, which will be validated by the //framework during each request Page.ViewStateUserKey = _antiXsrfTokenValue; //Create the non-persistent CSRF cookie var responseCookie = new HttpCookie(AntiXsrfTokenKey) { //Set the HttpOnly property to prevent the cookie from //being accessed by client side script HttpOnly = true , //Add the Anti-XSRF token to the cookie value Value = _antiXsrfTokenValue }; //If we are using SSL, the cookie should be set to secure to //prevent it from being sent over HTTP connections if (FormsAuthentication.RequireSSL && Request.IsSecureConnection) { responseCookie.Secure = true ; } //Add the CSRF cookie to the response Response.Cookies.Set(responseCookie); } Page.PreLoad += master_Page_PreLoad; } protected void master_Page_PreLoad( object sender, EventArgs e) { //During the initial page load, add the Anti-XSRF token and user //name to the ViewState if (!IsPostBack) { //Set Anti-XSRF token ViewState[AntiXsrfTokenKey] = Page.ViewStateUserKey; //If a user name is assigned, set the user name ViewState[AntiXsrfUserNameKey] = Context.User.Identity.Name ?? String.Empty; } //During all subsequent post backs to the page, the token value from //the cookie should be validated against the token in the view state //form field. Additionally user name should be compared to the //authenticated users name else { //Validate the Anti-XSRF token if (( string )ViewState[AntiXsrfTokenKey] != _antiXsrfTokenValue || ( string )ViewState[AntiXsrfUserNameKey] != (Context.User.Identity.Name ?? String.Empty)) { throw new InvalidOperationException( "Validation of " + "Anti-XSRF token failed." ); } } } }

Rohan Gupta · Answer

Hi Sanwar, this code not working for me please checkout protected override void OnInit(EventArgs e) { if (! this .Page.EnableViewStateMac) { throw new Exception( "MAC is not enabled for the page and the view state is therefore vulnerable to tampering." ); } ViewStateUserKey = Session.SessionID; base .OnInit(e); } private const string AntiXsrfToenKey = "__AntiXsrfToken" ; private const string AntiXsrfUserNmeKey = "__AntiXsrfUserName" ; private string _antiXsrfToenValue; protected void Page_Init( object sender, EventArgs e) { // The below code helps to protect from XSRF attacks var requestCookie = Request.Cookies[AntiXsrfToenKey]; Guid requestCookieGuidValue; if (requestCookie != null && Guid.TryParse(requestCookie.Value, out requestCookieGuidValue)) { // Use the Anti-XSRF token from the cookie _antiXsrfToenValue = requestCookie.Value; Page.ViewStateUserKey = _antiXsrfToenValue; } else { // Create new Anti-XSRF token and assign to the cookie _antiXsrfToenValue = Guid.NewGuid() .ToString( "N" ); Page.ViewStateUserKey = _antiXsrfToenValue; var responseCookie = new HttpCookie(AntiXsrfToenKey) { HttpOnly = true , Value = _antiXsrfToenValue }; Response.Cookies.Set(responseCookie); } }

Sanwar Ranwa · Answer

Can you share your code What issue you face exactly?

Rohan Gupta · Answer

Sanwar Ranwa i am using vs 2010 and first link not working

Rajeesh Menoth · Answer

Hi Rohan, Go with the following link these are completely ASP.NET web form and this will work because they are given a proper demo in that article. Reference : https://www.codeproject.com/Articles/686881/Hack-Proof-Your-ASP-NET-Applica https://forums.asp.net/t/1905820.aspx?How+to+Preventing+CSRF+Hacks+in+asp+net+web+form

Sanwar Ranwa · Answer

Rohan check these Links https://www.youtube.com/watch?v=2S1717ZqHjI https://www.youtube.com/watch?v=hW2ONyxAySY https://www.troyhunt.com/understanding-csrf-video-tutorial/

Rohan Gupta · Answer

Rajeesh Menoth not working your link

Rajeesh Menoth · Answer

Hi Rohan Gupta, You can check my stack over flow reference link.

Rohan Gupta · Answer

Sanwar Ranwa all links in MVC while my question on asp.net c#

Sanwar Ranwa · Answer

Hello Rohan Please check these Links https://docs.microsoft.com/en-us/aspnet/web-api/overview/security/preventing-cross-site-request-forgery-csrf-attacks https://www.codeproject.com/Articles/686881/Hack-Proof-Your-ASP-NET-Applica https://www.jardinesoftware.net/2013/01/07/asp-net-and-csrf/ https://stackoverflow.com/questions/8500249/how-to-implement-csrf-guard-in-asp-net

Rajeesh Menoth · Answer

Hi, You can refere the following article & thread for reference. Reference : https://docs.microsoft.com/en-us/aspnet/web-api/overview/security/preventing-cross-site-request-forgery-csrf-attacks https://stackoverflow.com/questions/8500249/how-to-implement-csrf-guard-in-asp-net

how to use csrfguard in asp.net c#

Answers (11)