跨网站请求伪造 - in .net在vs2013中使用网页表单

Question

使用VS 2013 for web表单的自动生成代码，它添加了CSRF保护。我需要做其他事情才能使其发挥作用吗？

它说令牌被添加到Page.ViewStateUserKey。我想如何检查ViewState？调试器说它是空的。

using System; 
using System.Collections.Generic; 
using System.Linq; 
using System.Web; 
using System.Web.Security; 
using System.Web.UI; 
using System.Web.UI.WebControls; 

namespace WebApplication12 
{ 
    public partial class SiteMaster : MasterPage 
    { 
     private const string AntiXsrfTokenKey = "__AntiXsrfToken"; 
     private const string AntiXsrfUserNameKey = "__AntiXsrfUserName"; 
     private string _antiXsrfTokenValue; 

     protected void Page_Init(object sender, EventArgs e) 
     { 
      // The code below helps to protect against XSRF attacks 
      var requestCookie = Request.Cookies[AntiXsrfTokenKey]; 
      Guid requestCookieGuidValue; 
      if (requestCookie != null && Guid.TryParse(requestCookie.Value, out requestCookieGuidValue)) 
      { 
       // Use the Anti-XSRF token from the cookie 
       _antiXsrfTokenValue = requestCookie.Value; 
       Page.ViewStateUserKey = _antiXsrfTokenValue; 
      } 
      else 
      { 
       // Generate a new Anti-XSRF token and save to the cookie 
       _antiXsrfTokenValue = Guid.NewGuid().ToString("N"); 
       Page.ViewStateUserKey = _antiXsrfTokenValue; 

       var responseCookie = new HttpCookie(AntiXsrfTokenKey) 
       { 
        HttpOnly = true, 
        Value = _antiXsrfTokenValue 
       }; 
       if (FormsAuthentication.RequireSSL && Request.IsSecureConnection) 
       { 
        responseCookie.Secure = true; 
       } 
       Response.Cookies.Set(responseCookie); 
      } 

      Page.PreLoad += master_Page_PreLoad; 
     } 

     protected void master_Page_PreLoad(object sender, EventArgs e) 
     { 
      if (!IsPostBack) 
      { 
       // Set Anti-XSRF token 
       ViewState[AntiXsrfTokenKey] = Page.ViewStateUserKey; 
       ViewState[AntiXsrfUserNameKey] = Context.User.Identity.Name ?? String.Empty; 
      } 
      else 
      { 
       // Validate the Anti-XSRF token 
       if ((string)ViewState[AntiXsrfTokenKey] != _antiXsrfTokenValue 
        || (string)ViewState[AntiXsrfUserNameKey] != (Context.User.Identity.Name ?? String.Empty)) 
       { 
        throw new InvalidOperationException("Validation of Anti-XSRF token failed."); 
       } 
      } 
     } 

     protected void Page_Load(object sender, EventArgs e) 
     { 

     } 
    } 
} 

Answer 1

我下载了Asp.net ViewState Helper。因为我使用4.5框架使用不同的cyprtoscheme，我不得不编辑web.config。

我加了这一点：

<system.web> 
    <machineKey compatibilityMode="Framework20SP1" /> 
    </system.web> 

然后我就能够使用提琴手和解密视图状态并证实XSRF令牌添加。