Cross Site Request Forgery (for web forms)

So Cross Site Request Forgery is a web security hole. It centers around tricking a user into going to a malicious page that has knowledge about the target system. The malicious page then makes requests to your sites using your authentication. This basically allows them to do whatever they want using your authentication and knowledge of your system.

The defense is an anti-forgery token. This is essentially a piece of unguessable data that is placed on your page. When a request is POSTed the server can check to confirm that this piece of data, or token, is there. The token can not be acquired by a malicious page so malicious pages can not make successful requests despite the fact that they can send a valid authorization cookie.

The malicious page can actually request the page with the token on it, but the browser will prevent that page from accessing this cross domain data unless the server indicates that it is allowed.

The Microsoft MVC approach involves storing the request token in the cookie and comparing the cookie value with the POSTed data value. Neither the cookie nor the token in the page can be accessed although the cookie is going to be sent. This is done so that the token does not need to be stored on the server in session making this more scalable.

For the project I am working on I put together a very quick AntiForgeryChecker for the web forms part of our application. To use it you add a HiddenInput field on your page:

<asp:HiddenField ID="antiforgery" runat="server"/>

and then make a call in your page load like:

AntiforgeryChecker.Check(this, antiforgery);

The actual object used is below. It uses session instead of the cookie, because we are already using session.

public static class AntiforgeryChecker

{

    public static void Check(Page page, HiddenField antiforgery)

    {

        if (!page.IsPostBack)

        {

            Guid antiforgeryToken = Guid.NewGuid();

            page.Session["AntiforgeryToken"] = antiforgeryToken;

            antiforgery.Value = antiforgeryToken.ToString();

        }

        else

        {

            Guid stored = (Guid) page.Session["AntiforgeryToken"];

            Guid sent = new Guid(antiforgery.Value);

            if (sent != stored)

            {

                throw new SecurityException("XSRF Attack Detected!");

            }

        }

    }

}