c# - Failing validation of Anti Forgery Token in Asp.net webform application -

i working on asp.net webforms application. trying implement anti forgery token functionality in application.

i have test case application called script in different file (csrf issue) using xhr. solution have implemented works until change value of viewstate in script.

following whole scenario.

look @ "\r\n" blah blah blah... ; in below script.

external script (csrf attack script):

    var xhr = new xmlhttprequest();     xhr.open("post", "myappdomain", true);     xhr.setrequestheader("accept", "text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8");     xhr.setrequestheader("accept-language", "en-us,en;q=0.5");     xhr.setrequestheader("content-type", "multipart\/form-data; boundary=---------------------------12421522427704");     xhr.withcredentials = true;     var body = "-----------------------------12421522427704\r\n" +       "content-disposition: form-data; name=\"element\"\r\n" +       "\r\n" +       "search here...\r\n" +       "-----------------------------12421522427704\r\n" +       "content-disposition: form-data; name=\"ddlrecordperpage_value\"\r\n" +       "\r\n" +       "-----------------------------12421522427704\r\n" +       "content-disposition: form-data; name=\"__eventargument\"\r\n" +       "\r\n" +       "btneditprofilesave|event|click\r\n" +       "-----------------------------12421522427704\r\n" +       "content-disposition: form-data; name=\"__viewstate\"\r\n" +       "\r\n" +       "\r\n" blah blah blah... ;     var abody = new uint8array(body.length);     (var = 0; < abody.length; i++)         abody[i] = body.charcodeat(i);     xhr.send(new blob([abody])); 

my solution in application:

if not page.ispostback     viewstate("antiforgerytoken") = "" else     dim outstring string = if(not string.isnullorempty(convert.tostring(viewstate("antiforgerytoken"))), convert.tostring(viewstate("antiforgerytoken")), "")     if string.isnullorempty(outstring) andalso outstring = "initialize"         throw new exception("unknown request source.")         ext.net.x.redirect(apppath() & "/login.aspx", "invalid request scope.")     end if     antiforgerychecker.check(me.page, outstring)     viewstate("antiforgerytoken") = outstring end if 

code block explanation:

when 1 of page loads, setting encrypted guid in viewstate in session. after it, when user makes server call, compare value of viewstate , session. if decrypted value of viewstate not match decrypted value of session, indicates method being called outside of application.

above solution works perfectly.

but when change value of viewstate following:

"**test**\r\n" blah blah blah... ; 

my code fails validate because goes if not page.ispostback then part , sets blank viewstate value. occurs adding "test" in script. asp.net experience may know issue here. please explain exact issue , solution case...

regards

so have found solution.

1. what here can check control caused postback.

2. now here when reload page return me nothing when injected script causes postback returns me control caused postback (here in case returns scriptmanager).

3. based on control can differentiate actual post event , further code accordingly.

please let me know if solution valid or can cause issue in future. found solution this post.

solution:

protected overrides sub onload(byval e eventargs)     try         dim controlpostback control = getcontrolthatcausedpostback(me)         if not page.ispostback             if controlpostback nothing                 viewstate("antiforgerytoken") = ""             end if         end if          dim outstring string = convert.tostring(viewstate("antiforgerytoken"))         antiforgerychecker.check(me.page, outstring, controlpostback)         viewstate("antiforgerytoken") = outstring      catch ex exception         handled()     end try end sub   private function getcontrolthatcausedpostback(page page) control     dim ctrl control = nothing     dim ctrlname string = page.request.params.[get]("__eventtarget")     if not [string].isnullorempty(ctrlname)         ctrl = page.findcontrol(ctrlname)     end if     return ctrl end function