Thursday, March 2, 2017
Prevent Cross-Site Request Forgery (XSRF/CSRF) attacks in ASP.NET Core
Prevent Cross-Site Request Forgery (XSRF/CSRF) attacks in ASP.NET Core
03/19/2018
13 minutes to read
Contributors
steve-smith Scott Addie Luke Latham Brian Chavez Isaac Levin all
By Steve Smith, Fiyaz Hasan, and Rick Anderson
Cross-site request forgery (also known as XSRF or CSRF, pronounced see-surf) is an attack against web-hosted apps whereby a malicious web app can influence the interaction between a client browser and a web app that trusts that browser. These attacks are possible because web browsers send some types of authentication tokens automatically with every request to a website. This form of exploit is also known as a one-click attack or session riding because the attack takes advantage of the user's previously authenticated session.
An example of a CSRF attack:
A user signs into www.good-banking-site.com using forms authentication. The server authenticates the user and issues a response that includes an authentication cookie. The site is vulnerable to attack because it trusts any request that it receives with a valid authentication cookie.
The user visits a malicious site, www.bad-crook-site.com.
Notice that the form's action posts to the vulnerable site, not to the malicious site. This is the "cross-site" part of CSRF.
The user selects the submit button. The browser makes the request and automatically includes the authentication cookie for the requested domain, www.good-banking-site.com.
The request runs on the www.good-banking-site.com server with the user's authentication context and can perform any action that an authenticated user is allowed to perform.
When the user selects the button to submit the form, the malicious site could:
Run a script that automatically submits the form.
Sends a form submission as an AJAX request.
Use a hidden form with CSS.
Using HTTPS doesn't prevent a CSRF attack. The malicious site can send an https://www.good-banking-site.com/ request just as easily as it can send an insecure request.
Some attacks target endpoints that respond to GET requests, in which case an image tag can be used to perform the action. This form of attack is common on forum sites that permit images but block JavaScript. Apps that change state on GET requests, where variables or resources are altered, are vulnerable to malicious attacks. GET requests that change state are insecure. A best practice is to never change state on a GET request.
