347

Could you explain ValidateAntiForgeryToken purpose and show me example about ValidateAntiForgeryToken in MVC 4?

I could not find any examples which explain this attribute?

2
  • 9
    Check this post prideparrot.com/blog/archive/2012/7/…
    – VJAI
    Nov 29, 2012 at 9:21
  • 1
    By the way, I really don't understand why MS haven't made it possible to put this right inside the .BeginForm helper. So this thing is there automatically, like in Rails
    – jazzcat
    Apr 16, 2017 at 16:29

3 Answers 3

384

MVC's anti-forgery support writes a unique value to an HTTP-only cookie and then the same value is written to the form. When the page is submitted, an error is raised if the cookie value doesn't match the form value.

It's important to note that the feature prevents cross site request forgeries. That is, a form from another site that posts to your site in an attempt to submit hidden content using an authenticated user's credentials. The attack involves tricking the logged in user into submitting a form, or by simply programmatically triggering a form when the page loads.

The feature doesn't prevent any other type of data forgery or tampering based attacks.

To use it, decorate the action method or controller with the ValidateAntiForgeryToken attribute and place a call to @Html.AntiForgeryToken() in the forms posting to the method.

14
  • 6
    @Chris It's both. As per my answer: "writes a unique value to an HTTP-only cookie and then the same value is written to the form" Apr 18, 2013 at 21:39
  • 27
    Why isn't this set by default? May 23, 2013 at 0:20
  • 14
    @Christian because it is not Ruby on Rails. ;-) Jan 26, 2014 at 21:07
  • 7
    It seems that the form __RequestVerificationToken and cookie __RequestVerificationToken are not the same, they work as a pair. Apr 8, 2015 at 15:54
  • 8
    In .NET Core It is possible to configure so that all requests would validate anti forgery token by default by adding a global filter services.AddMvc(options => { options.Filters.Add(new AutoValidateAntiforgeryTokenAttribute()); });
    – solo
    Aug 7, 2020 at 5:55
60

The basic purpose of ValidateAntiForgeryToken attribute is to prevent cross-site request forgery attacks.

A cross-site request forgery is an attack in which a harmful script element, malicious command, or code is sent from the browser of a trusted user. For more information on this please visit http://www.asp.net/mvc/overview/security/xsrfcsrf-prevention-in-aspnet-mvc-and-web-pages.

It is simple to use, you need to decorate method with ValidateAntiForgeryToken attribute as below:

[HttpPost]  
[ValidateAntiForgeryToken]  
public ActionResult CreateProduct(Product product)  
{
  if (ModelState.IsValid)  
  {
    //your logic 
  }
  return View(ModelName);
}

It is derived from System.Web.Mvc namespace.

And in your view, add this code to add the token so it is used to validate the form upon submission.

@Html.AntiForgeryToken()
1
  • Yes you are right,you need to call @Html.AntiForgeryToken() from your form and add the ValidateAntiForgeryTokenAttribute to the action method that you want to protect. Jan 11, 2015 at 16:24
16

In ASP.Net Core anti forgery token is automatically added to forms, so you don't need to add @Html.AntiForgeryToken() if you use razor form element or if you use IHtmlHelper.BeginForm and if the form's method isn't GET.

It will generate input element for your form similar to this:

<input name="__RequestVerificationToken" type="hidden" 
       value="CfDJ8HSQ_cdnkvBPo-jales205VCq9ISkg9BilG0VXAiNm3Fl5Lyu_JGpQDA4_CLNvty28w43AL8zjeR86fNALdsR3queTfAogif9ut-Zd-fwo8SAYuT0wmZ5eZUYClvpLfYm4LLIVy6VllbD54UxJ8W6FA">

And when user submits form this token is verified on server side if validation is enabled.

[ValidateAntiForgeryToken] attribute can be used against actions. Requests made to actions that have this filter applied are blocked unless the request includes a valid antiforgery token.

[AutoValidateAntiforgeryToken] attribute can be used against controllers. This attribute works identically to the ValidateAntiForgeryToken attribute, except that it doesn't require tokens for requests made using the following HTTP methods: GET HEAD OPTIONS TRACE

Additional information: learn.microsoft.com/aspnet/core/security/anti-request-forgery

Not the answer you're looking for? Browse other questions tagged or ask your own question.