防止PUT和删除请求ASP.NET Web API的CSRF攻击

Question

ValidateAntiForgeryToken是否适用于PUT和删除请求,或仅适用于ASP.NET Web API中的发布请求？如果没有,最安全的方法是什么？

Answer 1

Anti CSRF通常通过匹配来自cookie和body的令牌来完成,以在非ajax调用中验证请求,如浏览器表单帖子.

在ajax调用中,建议在自定义标头中放置一个标记.如果您安装了最新的ASP.NET 2012.2更新.它在MVC项目对话框中有一个spa模板,演示了如何在SPA应用程序中阻止CSRF.以下是从模板复制的代码,用于从服务器端验证标头令牌.

public class ValidateHttpAntiForgeryTokenAttribute : AuthorizationFilterAttribute
{
    public override void OnAuthorization(HttpActionContext actionContext)
    {
        HttpRequestMessage request = actionContext.ControllerContext.Request;

        try
        {
            if (IsAjaxRequest(request))
            {
                ValidateRequestHeader(request);
            }
            else
            {
                AntiForgery.Validate();
            }
        }
        catch (HttpAntiForgeryException e)
        {
            actionContext.Response = request.CreateErrorResponse(HttpStatusCode.Forbidden, e);
        }
    }

    private bool IsAjaxRequest(HttpRequestMessage request)
    {
        IEnumerable<string> xRequestedWithHeaders;
        if (request.Headers.TryGetValues("X-Requested-With", out xRequestedWithHeaders))
        {
            string headerValue = xRequestedWithHeaders.FirstOrDefault();
            if (!String.IsNullOrEmpty(headerValue))
            {
                return String.Equals(headerValue, "XMLHttpRequest", StringComparison.OrdinalIgnoreCase);
            }
        }

        return false;
    }

    private void ValidateRequestHeader(HttpRequestMessage request)
    {
        string cookieToken = String.Empty;
        string formToken = String.Empty;

        IEnumerable<string> tokenHeaders;
        if (request.Headers.TryGetValues("RequestVerificationToken", out tokenHeaders))
        {
            string tokenValue = tokenHeaders.FirstOrDefault();
            if (!String.IsNullOrEmpty(tokenValue))
            {
                string[] tokens = tokenValue.Split(':');
                if (tokens.Length == 2)
                {
                    cookieToken = tokens[0].Trim();
                    formToken = tokens[1].Trim();
                }
            }
        }

        AntiForgery.Validate(cookieToken, formToken);
    }
}

从客户端,您还需要在ajax调用中设置标头.这是来自todo.datacontext.js的代码:

function ajaxRequest(type, url, data, dataType) { // Ajax helper
    var options = {
        dataType: dataType || "json",
        contentType: "application/json",
        cache: false,
        type: type,
        data: data ? data.toJson() : null
    };
    var antiForgeryToken = $("#antiForgeryToken").val();
    if (antiForgeryToken) {
        options.headers = {
            'RequestVerificationToken': antiForgeryToken
        }
    }
    return $.ajax(url, options);
}