how to use csrfguard in asp.net c#

Rohan Gupta

7y3.1k.NET

how to use csrfguard in asp.net c#.. please tell me proper code for this problem

11 Replies

Know the answer? Post it — somebody with the same question will find it here.

Rohan Gupta7y ago
Another code is...
private const string AntiXsrfTokenKey = "__AntiXsrfToken";

private const string AntiXsrfUserNameKey = "__AntiXsrfUserName";

private string _antiXsrfTokenValue;

protected void Page_Init(object sender, EventArgs e)

{

//First, check for the existence of the Anti-XSS cookie

var requestCookie = Request.Cookies[AntiXsrfTokenKey];

Guid requestCookieGuidValue;

//If the CSRF cookie is found, parse the token from the cookie.

//Then, set the global page variable and view state user

//key. The global variable will be used to validate that it matches

//in the view state form field in the Page.PreLoad method.

if (requestCookie != null

&& Guid.TryParse(requestCookie.Value, out requestCookieGuidValue))

{

//Set the global token variable so the cookie value can be

//validated against the value in the view state form field in

//the Page.PreLoad method.

_antiXsrfTokenValue = requestCookie.Value;

//Set the view state user key, which will be validated by the

//framework during each request

Page.ViewStateUserKey = _antiXsrfTokenValue;

}

//If the CSRF cookie is not found, then this is a new session.

else

{

//Generate a new Anti-XSRF token

_antiXsrfTokenValue = Guid.NewGuid().ToString("N");

//Set the view state user key, which will be validated by the

//framework during each request

Page.ViewStateUserKey = _antiXsrfTokenValue;

//Create the non-persistent CSRF cookie

var responseCookie = new HttpCookie(AntiXsrfTokenKey)

{

//Set the HttpOnly property to prevent the cookie from

//being accessed by client side script

HttpOnly = true,

//Add the Anti-XSRF token to the cookie value

Value = _antiXsrfTokenValue

};

//If we are using SSL, the cookie should be set to secure to

//prevent it from being sent over HTTP connections

if (FormsAuthentication.RequireSSL &&

Request.IsSecureConnection)

{

responseCookie.Secure = true;

}

//Add the CSRF cookie to the response

Response.Cookies.Set(responseCookie);

}

Page.PreLoad += master_Page_PreLoad;

}

protected void master_Page_PreLoad(object sender, EventArgs e)

{

//During the initial page load, add the Anti-XSRF token and user

//name to the ViewState

if (!IsPostBack)

{

//Set Anti-XSRF token

ViewState[AntiXsrfTokenKey] = Page.ViewStateUserKey;

//If a user name is assigned, set the user name

ViewState[AntiXsrfUserNameKey] =

Context.User.Identity.Name ?? String.Empty;

}

//During all subsequent post backs to the page, the token value from

//the cookie should be validated against the token in the view state

//form field. Additionally user name should be compared to the

//authenticated users name

else

{

//Validate the Anti-XSRF token

if ((string)ViewState[AntiXsrfTokenKey] != _antiXsrfTokenValue

|| (string)ViewState[AntiXsrfUserNameKey] !=

(Context.User.Identity.Name ?? String.Empty))

{

throw new InvalidOperationException("Validation of " +

"Anti-XSRF token failed.");

}

}

}

}
0
Rohan Gupta7y ago
Hi Sanwar, this code not working for me please checkout
protected override void OnInit(EventArgs e)
{
if (!this.Page.EnableViewStateMac)
{
throw new Exception("MAC is not enabled for the page and the view state is therefore vulnerable to tampering.");
}
ViewStateUserKey = Session.SessionID;
base.OnInit(e);
}
private const string AntiXsrfToenKey = "__AntiXsrfToken";
private const string AntiXsrfUserNmeKey = "__AntiXsrfUserName";
private string _antiXsrfToenValue;
protected void Page_Init(object sender, EventArgs e)
{
// The below code helps to protect from XSRF attacks
var requestCookie = Request.Cookies[AntiXsrfToenKey];
Guid requestCookieGuidValue;
if (requestCookie != null && Guid.TryParse(requestCookie.Value, out requestCookieGuidValue))
{
// Use the Anti-XSRF token from the cookie
_antiXsrfToenValue = requestCookie.Value;
Page.ViewStateUserKey = _antiXsrfToenValue;
}
else
{
// Create new Anti-XSRF token and assign to the cookie
_antiXsrfToenValue = Guid.NewGuid()
.ToString("N");
Page.ViewStateUserKey = _antiXsrfToenValue;
var responseCookie = new HttpCookie(AntiXsrfToenKey)
{
HttpOnly = true,
Value = _antiXsrfToenValue
};
Response.Cookies.Set(responseCookie);
}
}
0
Sanwar Ranwa7y ago
Can you share your code What issue you face exactly?
0
Rohan Gupta7y ago
Sanwar Ranwa i am using vs 2010 and first link not working
0
Rajeesh Menoth7y ago
Hi Rohan,

Go with the following link these are completely ASP.NET web form and this will work because they are given a proper demo in that article.

Reference :

https://www.codeproject.com/Articles/686881/Hack-Proof-Your-ASP-NET-Applica

https://forums.asp.net/t/1905820.aspx?How+to+Preventing+CSRF+Hacks+in+asp+net+web+form
0
Sanwar Ranwa7y ago
Rohan check these Links

https://www.youtube.com/watch?v=2S1717ZqHjI

https://www.youtube.com/watch?v=hW2ONyxAySY

https://www.troyhunt.com/understanding-csrf-video-tutorial/
0
Rohan Gupta7y ago
Rajeesh Menoth not working your link
0
Rajeesh Menoth7y ago
Hi Rohan Gupta,

You can check my stack over flow reference link.
0
Rohan Gupta7y ago
Sanwar Ranwa all links in MVC while my question on asp.net c#
0
Sanwar Ranwa7y ago
Hello Rohan

Please check these Links

https://docs.microsoft.com/en-us/aspnet/web-api/overview/security/preventing-cross-site-request-forgery-csrf-attacks

https://www.codeproject.com/Articles/686881/Hack-Proof-Your-ASP-NET-Applica

https://www.jardinesoftware.net/2013/01/07/asp-net-and-csrf/

https://stackoverflow.com/questions/8500249/how-to-implement-csrf-guard-in-asp-net
0
Rajeesh Menoth7y ago
Hi,

You can refere the following article & thread for reference.

Reference :

https://docs.microsoft.com/en-us/aspnet/web-api/overview/security/preventing-cross-site-request-forgery-csrf-attacks

https://stackoverflow.com/questions/8500249/how-to-implement-csrf-guard-in-asp-net
0

how to use csrfguard in asp.net c#

Sanwar Ranwa i am using vs 2010 and first link not working

Rajeesh Menoth not working your link

Sanwar Ranwa all links in MVC while my question on asp.net c#