c# - Failing validation of Anti Forgery Token in Asp.net webform application -
i working on asp.net webforms application. trying implement anti forgery token functionality in application.
i have test case application called script in different file (csrf issue) using xhr. solution have implemented works until change value of viewstate in script.
following whole scenario.
look @ "\r\n" blah blah blah... ; in below script.
external script (csrf attack script):
var xhr = new xmlhttprequest(); xhr.open("post", "myappdomain", true); xhr.setrequestheader("accept", "text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8"); xhr.setrequestheader("accept-language", "en-us,en;q=0.5"); xhr.setrequestheader("content-type", "multipart\/form-data; boundary=---------------------------12421522427704"); xhr.withcredentials = true; var body = "-----------------------------12421522427704\r\n" + "content-disposition: form-data; name=\"element\"\r\n" + "\r\n" + "search here...\r\n" + "-----------------------------12421522427704\r\n" + "content-disposition: form-data; name=\"ddlrecordperpage_value\"\r\n" + "\r\n" + "-----------------------------12421522427704\r\n" + "content-disposition: form-data; name=\"__eventargument\"\r\n" + "\r\n" + "btneditprofilesave|event|click\r\n" + "-----------------------------12421522427704\r\n" + "content-disposition: form-data; name=\"__viewstate\"\r\n" + "\r\n" + "\r\n" blah blah blah... ; var abody = new uint8array(body.length); (var = 0; < abody.length; i++) abody[i] = body.charcodeat(i); xhr.send(new blob([abody])); my solution in application:
if not page.ispostback viewstate("antiforgerytoken") = "" else dim outstring string = if(not string.isnullorempty(convert.tostring(viewstate("antiforgerytoken"))), convert.tostring(viewstate("antiforgerytoken")), "") if string.isnullorempty(outstring) andalso outstring = "initialize" throw new exception("unknown request source.") ext.net.x.redirect(apppath() & "/login.aspx", "invalid request scope.") end if antiforgerychecker.check(me.page, outstring) viewstate("antiforgerytoken") = outstring end if code block explanation:
when 1 of page loads, setting encrypted guid in viewstate in session. after it, when user makes server call, compare value of viewstate , session. if decrypted value of viewstate not match decrypted value of session, indicates method being called outside of application.
above solution works perfectly.
but when change value of viewstate following:
"**test**\r\n" blah blah blah... ; my code fails validate because goes if not page.ispostback then part , sets blank viewstate value. occurs adding "test" in script. asp.net experience may know issue here. please explain exact issue , solution case...
regards
so have found solution.
what here can check control caused postback.
now here when reload page return me nothing when injected script causes postback returns me control caused postback (here in case returns scriptmanager).
based on control can differentiate actual post event , further code accordingly.
please let me know if solution valid or can cause issue in future. found solution this post.
solution:
protected overrides sub onload(byval e eventargs) try dim controlpostback control = getcontrolthatcausedpostback(me) if not page.ispostback if controlpostback nothing viewstate("antiforgerytoken") = "" end if end if dim outstring string = convert.tostring(viewstate("antiforgerytoken")) antiforgerychecker.check(me.page, outstring, controlpostback) viewstate("antiforgerytoken") = outstring catch ex exception handled() end try end sub private function getcontrolthatcausedpostback(page page) control dim ctrl control = nothing dim ctrlname string = page.request.params.[get]("__eventtarget") if not [string].isnullorempty(ctrlname) ctrl = page.findcontrol(ctrlname) end if return ctrl end function 
Comments
Post a Comment