Using MVC3’s AntiForgeryToken in HTTP GET to avoid Javascript CSRF vulnerability

by

The Asp.net MVC AntiForgeryToken won’t work through HTTP GET, because it relies on cookies which rely on HTTP POST (it uses the “Double Submit Cookies” technique described in the OWASP XSRF Prevention Cheat Sheet). You can also additionally protect the cookies sent to the client by setting the as httponly, so they cannot be spoofed via a script.

In this document you can find various techniques that can be used to prevent XSRF. It seems the you described would fall into the Approach 1. But we have a problem on how to retrieve the session on the server when using Ajax HTTP GET request since the cookies are not sent with the request. So you would also have to add a session identifier to you action’s URL (aka. cookieless sessions, which are easier to hijack). So in order to perform an attack the attacker would only need to know the correct URL to perform the GET request.

Perhaps a good solution would be to store the session data using some key from the users SSL certificate (for example the certs thumb-print). This way only the owner of the SSL certificate could access his session. This way you don’t need to use cookies and you don’t need to send session identifiers via query string parameters.

Anyway, you will need to roll out your own XSRF protection if you don’t want to use HTTP POST in Asp.net MVC.

More Related Contents:

  1. Setting Access-Control-Allow-Origin in ASP.Net MVC – simplest possible method
  2. json.Marshal(struct) returns “{}”
  3. jQuery Ajax calls and the Html.AntiForgeryToken()
  4. Spring MVC Multipart Request with JSON
  5. Load images based on dynamic path in ReactJs
  6. Error while installing json gem ‘mkmf.rb can’t find header files for ruby’
  7. Json.NET require all properties on deserialization
  8. Taking a JSON string, unmarshaling it into a map[string]interface{}, editing, and marshaling it into a []byte seems more complicated then it should be
  9. JSON integers: limit on size
  10. PostgreSQL return result set as JSON array?
  11. Get ffmpeg information in friendly way
  12. Python 3, read/write compressed json objects from/to gzip file
  13. How can I deserialize JSON with a top-level array using Serde?
  14. How to marshal a byte/uint8 array as json array in Go?
  15. How to create index on JSON field in Postgres?
  16. One dimensional array of strings being parsed to 2d by angular resource
  17. tsconfig.json: Build:No inputs were found in config file
  18. Deserialize JSON / NSDictionary to Swift objects
  19. Accessing Nested Map of Type map[string]interface{} in Golang
  20. How to fix Expected start-union. Got VALUE_NUMBER_INT when converting JSON to Avro on the command line?
  21. Swift JSONDecoder typeMismatch error
  22. IE9 JSON Data “do you want to open or save this file”
  23. change json file by bash script
  24. Use swift Codable to decode JSON with values as keys
  25. Swift 4 Codable – Bool or String values
  26. How to parse JSON from the Invoke-WebRequest in PowerShell?
  27. AngularJS Intercept all $http JSON responses
  28. How to escape single quotes into double quotes into single quotes
  29. Any when decoding JSON with Codable?
  30. Using VBA and VBA-JSON to access JSON data from WordPress API

Leave a Comment