CSRF Attack Prevention on .NET

In Addition to Rob's AntiXSS, we also need to secure CSRF Attack in Defence Jobs.

Here is what I found :

* Check this video to understand how the CSRF works & How you check your site if it is secure.

http://www.securitytube.net/Discovering-CSRF-with-OWASP%27s-CSRFTester-Tool-video.aspx

* Prevention

- ViewStateUserKey in (ASP.NET)

If you use viewstate in ASP.NET. it is recommended that you include ViewStateUserKey and Encript them

*(Include this on your base page)

protected override OnInit(EventArgs e)

{
base.OnInit(e);
if (User.Identity.IsAuthenticated)
ViewStateUserKey = Session.SessionID;

}

* Encript your viewstate in web.config (ViewStateEncriptionMode="Always")
http://msdn.microsoft.com/en-us/library/aa479501.aspx

Note:
However ViewStateUserKey this is not fully protect you from CSRF. This just to add an addition security layer to your application.
http://keepitlocked.net/archive/2008/05/29/viewstateuserkey-doesn-t-prevent-cross-site-request-forgery.aspx

* Recommended Prevention

Because ViewStateUserKey is not completely protect you from the CSRF Attack, You need to protect your application using per-request nonce to hidden form / URL

There are framework which can automatically done this.

* .NET CSRF GUARD http://www.owasp.org/index.php/.Net_CSRF_Guard

- This .NET version unfortunately only supply protection using URL method. (Nonce token is added on URL). This version doesn't support the hidden field method.

* ANTICSRF for ASP.NET (RECOMMENDED) http://idunno.org/archive/2008/12/14/announcing-anticsrf-for-asp.net.aspx

This framework (.NET HTTPModule) will added the per-request nonce to hidden field & cookies and validate it when post method or postback triggered.

========================================================

Installation of ANTICSRF http://anticsrf.codeplex.com/

- Add AntiCSRF.dll to Bin Folder

- Register AntiCSRF HttpModule on web config

 ....
 
   
  
 ....

- Configure Settings

   ....
   
       ....
       
  
       ....
   

    - If you don't want to proptect your page,
        you can add class attribute [Idunno.AntiCsrf.SuppressCsrfCheck]
        or page interface <%@ Implements Interface="Idunno.AntiCsrf.ISuppressCsrfCheck" %> 

==================================================================

 
How it works (ANTICSRF)
 
    * HTTP MODULE on PreSendRequestHeaders and PreRequestHandlerExecute
       
        context.PreSendRequestHeaders += PreSendRequestHeaders;
        context.PreRequestHandlerExecute += PreRequestHandlerExecute;

   * Adding pre-request nonce token
        - Add nonce on hidden field __CSRFTOKEN and cokkie __CSRFCOOKIE (configurable on settings)
    
     * Validate nonce token on hidden field with cokkie
 
        - It will validate the token when (POST Request or Postback)

 
        - Get Request will NOT be validated unless it is Postback
 
        - It will NOT validate any SuppressCsrfCheck class attribute or any class which inherits Idunno.AntiCsrf.ISuppressCsrfCheck
 
     * If Attack detected
        -When
            - hidden field or cookkie token are null/empty
        - hidden field and cookkie token is not match
     -ACTION (based on configuration setting detectionResult)
      - Throw an exception
        - Or redirect to other page based on configuration setting (errorPage)

==================================================================

Limitations of ANTICSRF

Non-ASP.NET forms are not protected with this module.

• You, the developer, must ensure your GET requests are idempotent (i.e. the side-effects of multiple identical requests are the same as for a single request). GET requests are not protected with this module. See http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html#sec9.1.2.

---------------------

* This Framework will not protect the GET Request (Except if it is postback).

For example
- when you use AJAX call using GET Request, It will not validate the token.

- But if you want to use AJAX call using the POST Request,
You must Suppress the AntiCSRF validation by what I mention above on the Intallation. by adding the attribute or page attribute.

Because If you don't suppress the AntiCSRF validation, it will detect as AntiCSRF Attack, because they can't find the token located on your hidden field.

Please have a read on How It Works explanation above.

---------------------