What is CSRF and how do you prevent it in ASP.NET?

Question

ICSM Computer · Answer

CSRF (Cross-Site Request Forgery) is a type of attack where a malicious website tricks a user's browser into making an unwanted request to a different site where the user is authenticated (like submitting a form or triggering an action without consent). Example of a CSRF Attack Imagine a user is logged in to bank.com, and visits a malicious site that silently submits: If the site doesn't verify the request origin, the bank may wrongly honor the request. How to Prevent CSRF in ASP.NET (MVC or Core) 1. Use Anti-Forgery Tokens ASP.NET MVC and Core provide built-in anti-forgery token mechanisms. In Razor Views: In Controller: The @Html.AntiForgeryToken() generates a hidden field with a token, and the [ValidateAntiForgeryToken] attribute validates it. 2. For Web APIs For APIs (which don’t use cookies by default), CSRF is less common unless using cookie-based auth. If so: Require clients to send an anti-CSRF token via a custom header (e.g. X-CSRF-TOKEN) Validate it manually or using middleware 3. Use SameSite Cookie Attribute In .NET Core, set your auth cookie to: This prevents browsers from sending cookies on cross-site requests. 4. Disable Cross-Origin for Unsafe Methods Only allow safe GET requests from cross-origin sources.Block POST, PUT, DELETE, etc. using CORS unless you explicitly trust the source. Summary Technique Applies To Purpose @Html.AntiForgeryToken() MVC Views Embed anti-CSRF token in form [ValidateAntiForgeryToken] Controller Action Validate token presence/validity SameSite=Strict Cookies Prevent cross-origin cookie send CORS Restrictions Web APIs Block untrusted origins Custom Header Tokens Web APIs Manually validate via header

What is CSRF and how do you prevent it in ASP.NET?

1 Answers

Example of a CSRF Attack

How to Prevent CSRF in ASP.NET (MVC or Core)

1. Use Anti-Forgery Tokens

In Razor Views:

In Controller:

2. For Web APIs

3. Use `SameSite` Cookie Attribute

4. Disable Cross-Origin for Unsafe Methods

Summary

Technique	Applies To	Purpose
`@Html.AntiForgeryToken()`	MVC Views	Embed anti-CSRF token in form
`[ValidateAntiForgeryToken]`	Controller Action	Validate token presence/validity
`SameSite=Strict`	Cookies	Prevent cross-origin cookie send
CORS Restrictions	Web APIs	Block untrusted origins
Custom Header Tokens	Web APIs	Manually validate via header

forum

What is CSRF and how do you prevent it in ASP.NET?

Can you answer this question?

1 Answers

Example of a CSRF Attack

How to Prevent CSRF in ASP.NET (MVC or Core)

1. Use Anti-Forgery Tokens

In Razor Views:

In Controller:

2. For Web APIs

3. Use SameSite Cookie Attribute

4. Disable Cross-Origin for Unsafe Methods

Summary

3. Use `SameSite` Cookie Attribute