Generating AntiForgeryToken in WebForms

Implementing it yourself is not too difficult.

  • Generate a GUID
  • Put it in a hidden field
  • Also put it in Session or Cookie (in the latter case, with some anti-tamper protection)
  • At the start of processing the form compare the field and stored token.

(If you look at the implementation of MVC, there is very little more to it. A few helper methods is all you need.)

Leave a Comment