Responsible use of the ASP.NET MVC AntiForgeryToken


The use of anti-forgery tokens is a necessary safeguard against cross-site request forgery attacks. The ASP.NET MVC framework provides easy-to-use security mechanisms right out of the box, but unfortunately these are opt-in rather than opt-out and are easy to miss/forget. For a non-trivial website it is difficult to guarantee tokens are supplied and checked in all form submissions and AJAX posts. This is how I do it.
Note: Web security is a tricky business and I do not consider myself a security expert. Use the information in this post at your own risk.

1. Use the ValidateJsonAntiForgeryToken attribute for AJAX calls

There's a nice post by Johan Driessen on anti-XSRF validation with newer versions of the .NET framework. I use Johan's ValidateJsonAntiForgeryToken attribute to great effect. In summary, Johan's attribute should be applied to actions invoked via AJAX calls. Check out his blog post - it explains everything in detail.

2. Ensure all AJAX posts contain a verification token

In my root layout file (master page) I use the following code to set expectations for jQuery AJAX calls. Prior to executing a call, the request verification token is read from the current page (Note: a Html.AntiForgeryToken call needs to be in place in every page which will utilize ajax posts) and passed into the request header. This saves me from needing to specify a token every time I create an AJAX call. (This can easily be modified to only send the token for desired HTTP verbs)
Loading ....

3. Ensure all POST methods have validation attributes applied

It's very easy to forget to apply the ValidateAntiForgeryToken attribute when developing new actions. I have a little unit test that I run to ensure that all post methods have either ValidateAntiForgeryToken or ValidateJsonAntiForgeryToken applied. The test fails and prints a list of offender actions when appropriate. This is a lifesaver when, inevitably, I'm developing some new functionality in a rush and haven't given security its appropriate consideration (hopefully this is a rarity).
Loading ....
Hopefully this saves somebody some time. Let me know if there are any considerations that I have missed, or if you know of a more elegant method of achieving the same!

Comments

Post a Comment

Popular posts from this blog

Excel - Adding an existing Pivot table to the data model

Image
  I've been working more with, and continue to be amazed by, Power Pivot. I recently ran into an issue where I needed to add the data for an existing Power Pivot report to the Data Model. There is a checkbox that makes this easy when creating a PivotTable: As so often happens, the analysis grew in scope/importance and I found myself needing to add the data to the data model. While it's not obvious how, there is a way to add an existing Pivot table to the data model. There's a More Tables... link in the PivotTable Fields pane.  Clicking on the  More Tables... results in a dialog confirming that you want to Create a New PivotTable .  Doing so will result in the creation of the new PivotTable in a new sheet. By default the data is added to the data model. You'll likely lose some formatting but for anything other than a trivial PivotTable, this should save effort, as it did for me.
Read more

Getting Started with Mirth (Part 1)

Image
This is the first post in a 2 part series. The second post is here Recently I posted about my positive experience when using Mirth by Webreach as an open source communication layer between one of our in-house applications and a third party and proprietary web service interface. That post received a large amount of attention (relative to my other posts :o) ) so now I will post a quickstart guide to creating a similar setup. In this post I will go over the very basics of using Mirth (please dig in and play around with some more advanced options/configurations), specifically I will demonstrate how to use Mirth to read data from a database, package the data up in a SOAP envelope, send the data to a web service and process the SOAP response. I'll also show you how easy it is to monitor channels once deployed. Once you've installed and opened Mirth for the first time you'll be presented with an empty dashboard - but it wont stay empty for long. This is where you'll s...
Read more

Mirth

Image
Introduction Let's talk about Mirth. At it's simplest, Mirth  link is an Open Source HL7 interface engine. HL7 (Health Level 7) is an NPO involved in the development of healthcare standards and the HL7 v2.x and HL7 v3 standards are commonly used in Medical Information for data interchange - including but not limited to clinical, financial, logistical and administrative messaging. I first ran across Mirth over a year ago on a personal quest to find an alternative to our client's legacy HL7 application. Academically, I wrote a number of lexical analysis tools using lexx, yacc, bison and JavaCC and knew the challenges of writing and maintaining complex parsers. I was simply looking for something that could parse HL7 for us, and perhaps log messages and provide a little more transparency than our application currently allowed.  A year later and our legacy application is still going strong (read: my proposal was declined), but Mirth is being used in production, far away from th...
Read more