how to prevent CSRF attack in asp.net

You could try the following. In the Web-Form add:

<%= System.Web.Helpers.AntiForgery.GetHtml() %>

This will add a hidden field and a cookie. So if you fill out some form data and post it back to the server you need a simple check:

protected void Page_Load(object sender, EventArgs e)
{
if (IsPostBack) AntiForgery.Validate();
}

protected void Page_Load(object sender, EventArgs e)
{
if (IsPostBack) AntiForgery.Validate();
}
AntiForgery.Validate();

ViewStateUserKey & Double Submit Cookie

Starting with Visual Studio 2012, Microsoft added built-in CSRF protection to new web forms application projects. To utilize this code, add a new ASP .NET Web Forms Application to your solution and view the Site.Master code behind page. This solution will apply CSRF protection to all content pages that inherit from the Site.Master page.

The following requirements must be met for this solution to work:

All web forms making data modifications must use the Site.Master page. All requests making data modifications must use the ViewState. The web site must be free from all Cross-Site Scripting (XSS) vulnerabilities. See how to fix Cross-Site Scripting (XSS) using Microsoft .Net Web Protection Library for details.

You can also implement it by yourself

Generate a GUID

Put it in a hidden field

Also put it in Session or Cookie (in the latter case, with some anti-tamper protection)

At the start of processing the form compare the field and stored token.

(If you look at the implementation of MVC, there is very little more to it. A few helper methods is all you need.)

6 Replies

Know the answer? Post it — somebody with the same question will find it here.

Rohan Gupta7y ago
not working SANWAR
0
Sanwar Ranwa7y ago
Check this it may help you

https://www.c-sharpcorner.com/article/csrf-attack-and-its-prevention-mechanism/
0
Rohan Gupta7y ago
not working in asp.net
0
Suraj Kumar7y ago
You could try the following. In the Web-Form add:
<%= System.Web.Helpers.AntiForgery.GetHtml() %>

This will add a hidden field and a cookie. So if you fill out some form data and post it back to the server you need a simple check:
protected void Page_Load(object sender, EventArgs e)

{

if (IsPostBack) AntiForgery.Validate();

}

protected void Page_Load(object sender, EventArgs e)

{

if (IsPostBack) AntiForgery.Validate();

}

AntiForgery.Validate();

ViewStateUserKey & Double Submit Cookie

Starting with Visual Studio 2012, Microsoft added built-in CSRF protection to new web forms application projects. To utilize this code, add a new ASP .NET Web Forms Application to your solution and view the Site.Master code behind page. This solution will apply CSRF protection to all content pages that inherit from the Site.Master page.

The following requirements must be met for this solution to work:

All web forms making data modifications must use the Site.Master page. All requests making data modifications must use the ViewState. The web site must be free from all Cross-Site Scripting (XSS) vulnerabilities. See how to fix Cross-Site Scripting (XSS) using Microsoft .Net Web Protection Library for details.

You can also implement it by yourself

Generate a GUID

Put it in a hidden field

Also put it in Session or Cookie (in the latter case, with some anti-tamper protection)

At the start of processing the form compare the field and stored token.

(If you look at the implementation of MVC, there is very little more to it. A few helper methods is all you need.)
0
Rajeesh Menoth7y ago
Hi Rohan,

Please refer the microsoft document for Both Asp.Net & MVC and ASP.NET Core Prevent Cross-Site Request Forgery.

Reference :

https://docs.microsoft.com/en-us/aspnet/core/security/anti-request-forgery?view=aspnetcore-2.2
0
Sanwar Ranwa7y ago
Hello Rohan

Please check these Links

https://www.c-sharpcorner.com/article/csrf-attack-and-its-prevention-mechanism/

https://stackoverflow.com/questions/29939566/preventing-cross-site-request-forgery-csrf-attacks-in-asp-net-web-forms

https://software-security.sans.org/developer-how-to/developer-guide-csrf
0