Benutzer:MovGP0/ASP.NET Core/Anti-Forgery

MovGP0

Über mich

Hilfen

Artikel

Weblinks

Literatur

Zitate

Notizen

Programmierung

MSCert

Physik

Programmierung ASP.NET Common OWIN • Razor • WebForms • MVC • WebAPI Core Configuration • Data Protection API • Dependency Injection • Routing Attack Vectors HTTPS • HSTS • HPKP • CSP • CSRF • Anti-XSS • CORS • Open Redirection • Click-Jacking Libraries OpenID • Azure AD

Cross-Site Request Forgery (CSRF)

Synchronizer Token Pattern (STP)

<input type="hidden" name="csrftoken" value="KbyUmhTLMpYj7CD2di7JKP1P3qmLlkPt" />

• All MVC-Forms have an anti forgery token

  @using (Html.BeginForm("ChangePassword", "Manage"))
  {
      // ...
  }
  

• Provide token manually if form is is HTML

  <form action="/" method="post">
      @Html.AntiForgeryToken()
  </form>
  

Validation

Validation of the token is done by placing an attribute on the MVC controller or method.

An attribute given on a lower level overrides attributes at a higher level

[ValidateAntiForgeryToken]	always validate the token
[AutoValidateAntiforgeryToken]	validate the token except for GET, HEAD, OPTIONS, TRACE
[IgnoreAntiforgeryToken]	do not validate the token (use for save methods only)

Microsoft.AspNetCore.Antiforgery

services.AddAntiforgery(options => {
    options.FormFieldName = "csrftoken";
    options.RequireSsl = true;
});

Cookie

Wird im HTTP-Header deklariert:

Set-Cookie: Csrf-token=i8XNjC4b8KVok4uw5RftR38Wgp2BFwql; expires=Thu, 23-Jul-2015 10:25:33 GMT; Max-Age=31449600; Path=/

• MUST NOT have an httpOnly flag! Needs te be processed by JavaScript.

Microsoft.AspNetCore.Antiforgery

services.AddAntiforgery(options => {
    options.CookieName = "CsrfCookie";
    options.CookiePath = "/";
    options.CookieDomain = "example.com";
    options.RequireSsl = true;
});

HTTP-Header / REST

Microsoft.AspNetCore.Antiforgery

services.AddAntiforgery(options => {
    options.HeaderName = "X-Csrf-Token";
    options.RequireSsl = true;
});

There are multiple headers used:

HTTP-Headers

X-Csrf-Token	Standard
X-XSRF-TOKEN	Angular
X-Requested-With	jQuery
X-CSRF-TOKEN	Java Play Framework
X-Requested-By	Oracle Jersey

Manuelle Validierung:

csrf_token = HMAC(session_token, application_secret)

XMLHttpRequests

For old Browsers that allow Cross-Site XMLHttpRequests, the Origin headers have to be checked:

// pass if Origin header is ok
var expected = new Regex("^https?://myserver.com$"); // compare with URI for production code
var origin = request.Headers["Origin"].SingleOrDefault();
if(expected.Matches(origin)) return Next(request);

// pass if the request was not done with XmlHttpRequest
var requestedWith = request.Headers["X-Requested-With"];
if(!requestedWith.Any(rw => rw.Equals("XmlHttpRequest", StringComparison.InvariantCultureIgnoreCase))) return Next(request);

// deny otherwise
var response = context.Response;
response.StatusCode = 401;
return response.WriteAsync("Access denied.");

Verteilte .NET Core Anwendung

Bei einer verteilten .NET Core Anwendung muss das Application Secret (IAntiForgery) und der AntiforgeryTokenStore (IAntiforgeryTokenStore) zentral implementiert und in der DI überschrieben werden.

Siehe auch: Microsoft.AspNetCore.Antiforgery

Quellen

• Steve Smith, Fiyaz Hasan: Preventing Cross-Site Request Forgery (XSRF/CSRF) Attacks in ASP.NET Core. In: ASP.NET Core Docs. Microsoft, 14. Februar 2017, abgerufen am 12. Mai 2017 (englisch). 
• Fiyaz Bin Hasan: Preventing XSRF in AngularJS Apps with ASP.NET CORE Anti-Forgery Middleware. 13. April 2016, abgerufen am 12. Mai 2017 (englisch). 

|}