The document discusses cross-site request forgery (XSRF/CSRF) attacks and how to prevent them in ASP.NET Core applications. It explains that XSRF attacks trick authenticated users into performing unwanted actions on a web application. To prevent XSRF, ASP.NET Core uses antiforgery tokens that are validated on requests. It provides built-in support for adding antiforgery tokens to MVC forms and tag helpers. Additionally, antiforgery middleware can validate tokens on incoming requests to the application.

1. .NET CORE Security
Fiyaz Hasan

2. Preventing XSRF
in ASP.NET Core

3. XSRF…what?

4. “Cross Site Request Forgery
(XSRF/CSRF) is a type of security
breech where a hacker can trick the
user into making unwanted
requests for a web application
where the user is already
authenticated

5. Authentication
Systems

6. Cookie Based
Browser Server
Authenticate
username=…&password=…
HTTP 200 OK
Set-Cookie: session=…
GET /controller/action
Cookie: session=…
HTTP 200 OK
{ data: “data“ }
Find and desirialize
session from database

7. Are Cookies Evil?

8. Token Based
Browser Server
Authenticate
username=…&password=…
HTTP 200 OK
{token: ‘JWT’}
GET /api/action
Authorization: Bearer {JWT}
HTTP 200 OK
{ data: “data“ }
Validate Token

9. User Token &
Antiforgery Token
Aren’t Same

10. Antiforgery System
Browser Server
Particular Route Request
HTTP 200 OK
Set Cookie:
antiforgery.token=…
POST /controller/action
Hidden __RequestVerificationToken field
HTTP 200 OK
{ data: “data“ }
Checks if this token is
validated
Create And Store
Token then send the
token in the response

11. Built-in support for
MVC
Forms
HtmlHelpers
Html.BeginForm("Add", "Transaction")
TagHelpers
<form asp-controller="Transaction" asp-
action="Add“>

12. Antiforgery
Middlerware

13. Thanks!
Any questions?
You can find me at:
@FiyazBinHasan
www.fiyazhasan.me