Click here to Skip to main content
15,883,883 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
I am doing csrf token validation in asp.net with c#.
I am sending the cookie as a separate header.
I am getting the exception of Invalid view state while doing the same.
My core code is updated as below

What I have tried:

Code is as below:
 var requestCookie = Request.Cookies[AntiXsrfTokenKey];
                Guid requestCookieGuidValue;
                if (requestCookie != null && TryParseGuid(requestCookie.Value, out requestCookieGuidValue))
                {
                   
                    // Use the Anti-XSRF token from the cookie
                    _antiXsrfTokenValue = requestCookie.Value;
                   
                    Page.ViewStateUserKey = _antiXsrfTokenValue;
                   
                }
                else
                {
                    
                    _antiXsrfTokenValue = Guid.NewGuid().ToString("N");
                   Page.ViewStateUserKey = _antiXsrfTokenValue;
                    /for setting AntiXSRF Token Value as a separate header XSRFHeader instead in theresponse header Start
                    //Response.Cookies.Set(responseCookie);
                     Response.AppendHeader("XSRFHeader", _antiXsrfTokenValue);
                  }
                    
 Page.PreLoad += csrf_Page_PreLoad;

protected void csrf_Page_PreLoad(object sender, EventArgs e)
        {
            try
            {
                Common.WriteDDSLog("csrf_Page_PreLoad Started ...............");
                if (!IsPostBack)
                {
                    // Set Anti-XSRF token
                   
                    ViewState[AntiXsrfTokenKey] = Page.ViewStateUserKey;
                    ViewState[AntiXsrfUserNameKey] = Context.User.Identity.Name ?? String.Empty;
                    
                }
                else
                {
                    
                    // Validate the Anti-XSRF token
                    if ((string)ViewState[AntiXsrfTokenKey] != _antiXsrfTokenValue
                        || (string)ViewState[AntiXsrfUserNameKey] != (Context.User.Identity.Name ?? String.Empty))
                    {
                        Common.WriteDDSLog("Validation of Anti-XSRF token failed in csrf_Page_PreLoad");
                        Response.Redirect("~/CustomError.aspx", false);

                    }
                   
                }

            }
            catch (Exception ex)
            {
                
        }

        #endregion Code for adding anti-csrf token
Posted
Updated 16-Aug-22 5:53am
v3
Comments
Richard Deeming 17-Aug-22 3:46am    
Your code tries to read a cookie, but the line which actually sets the cookie is commented out.

Appending a non-standard header won't have any effect (unless you also wrote the browser that's used to access your application and added support for that specific header).

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900