The tutorials I've read tell you to use [ValidateAntiForgeryToken] attributes and <%= Html.AntiForgeryToken() %> in your code.

I was wondering why this isn't a built-in automatic setting or at least a global toggle in the web.config. Perhaps it is, and I haven't realised, but I am doing it by hand and I can't help but wonder if there is a good reason for not handling it automatically behind the scenes. Any ideas?

  • How do you want to automatically handle it for AJAX requests? – Florian Margaine Jun 14 '13 at 10:01
  • I don't think it'd apply to AJAX requests, but if you're applying it to all incoming requests it won't matter if it is unable to add the request key to the AJAX because you'll simply get an anti forgery exception, which is safe because you'll realise you need to include it when you're testing, rather than the opposite which is things get through without you realising. Although you could leave AJAX entirely up to the user to consider. At the moment I'm just adding [ValidateAntiForgeryToken] attributes to every single post method and wondering why. – NibblyPig Jun 14 '13 at 10:04
  • 1
    Then another reason might be that CSRF protection is kind of useless for anonymous users. – Florian Margaine Jun 14 '13 at 10:06
  • It's a good question but impossible to answer without talking to someone from Microsoft. – Rocklan Jun 14 '13 at 12:32

I think in most cases it doesn't really matter if a form was issued by your server or not.

Anti-forgery tokens require session state on the server. When a user session expires so will the forms they have open, they become unpostable. Can be pretty annoying.

  • 1
    Unless that form was posted from a malicious site to do something like delete your account, withdraw funds, etc depending on what sites you are logged into. You should look more into cross site request forgeries and related attacks – Schmidty Nov 7 '13 at 22:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.