Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The AntiForgeryToken is used to prevent CSRF attacks, however the links on MSDN don't give me much insight to what exactly the AntiForgeryToken does, or how it works, or why things are done the way they are.

From what I gather, it creates a hash inside a web page and a cookie. One or both of them use the hashed IPrincipal.Name, and use symmetric encryption.

Can anyone shed light as to:

  1. How the AntiForgeryToken works internally
  2. What should it be used to protect
  3. What should it NOT be used to protect
  4. What is the reasoning behind the implementation choices for #1 above?
share|improve this question
This is a great question, but I think it belongs on SO. – Steve Feb 6 '11 at 17:06
Link to S.O.… – LamonteCristo Feb 6 '11 at 19:07

All CSRF is prevented by the use of cryptographic nonce which cannot be obtained by the attacker due to Same-Origin Policy. This is not a problem that Symmetric Cryptography can solve.

Check out the CSRF Prevention Cheat Sheet.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.