how to prevent CSRF attack in asp.net

Question

Rohan Gupta · Answer

not working SANWAR

Sanwar Ranwa · Answer

Check this it may help you https://www.c-sharpcorner.com/article/csrf-attack-and-its-prevention-mechanism/

Rohan Gupta · Answer

not working in asp.net

Suraj Kumar · Answer

You could try the following. In the Web-Form add: This will add a hidden field and a cookie. So if you fill out some form data and post it back to the server you need a simple check: protected void Page_Load( object sender, EventArgs e) { if (IsPostBack) AntiForgery.Validate(); } protected void Page_Load( object sender, EventArgs e) { if (IsPostBack) AntiForgery.Validate(); } AntiForgery.Validate(); ViewStateUserKey & Double Submit Cookie Starting with Visual Studio 2012, Microsoft added built-in CSRF protection to new web forms application projects. To utilize this code, add a new ASP .NET Web Forms Application to your solution and view the Site.Master code behind page. This solution will apply CSRF protection to all content pages that inherit from the Site.Master page. The following requirements must be met for this solution to work: All web forms making data modifications must use the Site.Master page. All requests making data modifications must use the ViewState. The web site must be free from all Cross-Site Scripting (XSS) vulnerabilities. See how to fix Cross-Site Scripting (XSS) using Microsoft .Net Web Protection Library for details. You can also implement it by yourself Generate a GUID Put it in a hidden field Also put it in Session or Cookie (in the latter case, with some anti-tamper protection) At the start of processing the form compare the field and stored token. (If you look at the implementation of MVC, there is very little more to it. A few helper methods is all you need.)

Rajeesh Menoth · Answer

Hi Rohan, Please refer the microsoft document for Both Asp.Net & MVC and ASP.NET Core Prevent Cross-Site Request Forgery. Reference : https://docs.microsoft.com/en-us/aspnet/core/security/anti-request-forgery?view=aspnetcore-2.2

Sanwar Ranwa · Answer

Hello Rohan Please check these Links https://www.c-sharpcorner.com/article/csrf-attack-and-its-prevention-mechanism/ https://stackoverflow.com/questions/29939566/preventing-cross-site-request-forgery-csrf-attacks-in-asp-net-web-forms https://software-security.sans.org/developer-how-to/developer-guide-csrf