Click here to Skip to main content
15,883,988 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
Anyone can help me on this.
I have implemented CSRF code into
C#
baseclass.cs

in my asp.net project but it is not working. but when I placed that code into master page it works for me.

What should I do to implement it in
C#
baseclass.cs


What I have tried:

C#
public class BaseClass : System.Web.UI.Page, IDisposable
{


C#
private const string AntiXsrfTokenKey = "__AntiXsrfToken";
private const string AntiXsrfUserNameKey = "__AntiXsrfUserName";
private string _antiXsrfTokenValue;

protected override void OnInit(EventArgs e)
{
    // The code below helps to protect against XSRF attacks
    var requestCookie = Request.Cookies[AntiXsrfTokenKey];
    Guid requestCookieGuidValue;
    if (requestCookie != null && Guid.TryParse(requestCookie.Value, out requestCookieGuidValue))
    {
        // Use the Anti-XSRF token from the cookie
        _antiXsrfTokenValue = requestCookie.Value;
        Page.ViewStateUserKey = _antiXsrfTokenValue;
    }
    else
    {
        // Generate a new Anti-XSRF token and save to the cookie
        _antiXsrfTokenValue = Guid.NewGuid().ToString("N");
        Page.ViewStateUserKey = _antiXsrfTokenValue;

        var responseCookie = new HttpCookie(AntiXsrfTokenKey)
        {
            HttpOnly = true,
            Value = _antiXsrfTokenValue
        };
        if (FormsAuthentication.RequireSSL && Request.IsSecureConnection)
        {
            responseCookie.Secure = true;
        }
        Response.Cookies.Set(responseCookie);
    }

    Page.PreLoad += master_Page_PreLoad;
}

protected void master_Page_PreLoad(object sender, EventArgs e)
{
    if (!IsPostBack)
    {
        // Set Anti-XSRF token
        ViewState[AntiXsrfTokenKey] = Page.ViewStateUserKey;
        ViewState[AntiXsrfUserNameKey] = Context.User.Identity.Name ?? String.Empty;
    }
    else
    {
        // Validate the Anti-XSRF token
        if ((string)ViewState[AntiXsrfTokenKey] != _antiXsrfTokenValue
            || (string)ViewState[AntiXsrfUserNameKey] != (Context.User.Identity.Name ?? String.Empty))
        {
            throw new InvalidOperationException("Validation of Anti-XSRF token failed.");
        }
    }
}

}
Posted
Updated 15-Nov-16 23:42pm
v2
Comments
Nathan Minier 16-Nov-16 7:40am    
If you're using System.Web, why aren't you using the built in AntiForgeryToken?
Richard Deeming 16-Nov-16 9:57am    
Is that available for WebForms? I've only ever seen it mentioned in relation to MVC.
Nathan Minier 16-Nov-16 10:42am    
It is, thanks to AntiForgery.GetHtml().
https://msdn.microsoft.com/en-us/library/gg537903(v=vs.111).aspx

In the individual Page_Load you should just be able to
if(IsPostBack){AntiForgery.Validate();}, providing you set the token on that page.

I haven't cracked the source open, but from what I understand the token is hashed from the path, so if you have pages that don't lean on the Master page you'll need to assign it per-page.

IMO your best bet is to make a master that simply carries the anti-validation, though, and build templates out from there.

Have a look at the MSDN notes for the class:
https://msdn.microsoft.com/en-us/library/system.web.helpers.antiforgery(v=vs.111).aspx

Richard Deeming 16-Nov-16 10:49am    
Nice! Thanks. :)

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900