Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Re: [WEB SECURITY] Preventing Cross-site Request Forgeries [ASP.NET crowd]
From: "Michael Sutton" <msutton () spidynamics com>
Date: Fri, 30 Mar 2007 18:58:50 -0400

The EnableEventValidation page directive (enabled by default since .Net
2.0) applies a nonce value for form validation and is also a strong
control to prevent CSRF attacks. 

Michael Sutton
Security Evangelist
SPI Dynamics
http://portal.spidynamics.com/blogs/msutton

-----Original Message-----
From: Chris Weber [mailto:chris () lookout net]
Sent: Friday, March 30, 2007 6:12 PM
To: 'pdp (architect)'; full-disclosure () lists grok org uk; 'WASC
Forum';
'webappsec @OWASP'
Subject: RE: [WEB SECURITY] Preventing Cross-site Request Forgeries
[ASP.NET crowd]

Nice article.

For the ASP.NET crowd out there, the will be even more simple, one
line of
code.  Set the ViewStateUserKey property in your base class or page
and
the
unique token protections (similar to CSRF_Guard) will be provided for
you.

http://msdn2.microsoft.com/en-
us/library/system.web.ui.page.viewstateuserkey
.aspx

This protection mechanism has been available for many years, since the
Framework 1.1





-----Original Message-----
From: pdp (architect) [mailto:pdp.gnucitizen () googlemail com]
Sent: Friday, March 30, 2007 3:16 AM
To: full-disclosure () lists grok org uk; WASC Forum; webappsec @OWASP
Subject: [WEB SECURITY] Preventing Cross-site Request Forgeries

http://www.gnucitizen.org/blog/preventing-csrf

I briefly covered how simple it is to prevent CSRF attacks. Hope that
you
find it useful.

--
pdp (architect) | petko d. petkov
http://www.gnucitizen.org


------------------------------------------------------------------------
--
--
Join us on IRC: irc.freenode.net #webappsec

Have a question? Search The Web Security Mailing List Archives:
http://www.webappsec.org/lists/websecurity/

Subscribe via RSS:
http://www.webappsec.org/rss/websecurity.rss [RSS Feed]



------------------------------------------------------------------------
--
--
Join us on IRC: irc.freenode.net #webappsec

Have a question? Search The Web Security Mailing List Archives:
http://www.webappsec.org/lists/websecurity/

Subscribe via RSS:
http://www.webappsec.org/rss/websecurity.rss [RSS Feed]

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault