Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

The AntiForgeryToken is used to prevent CSRF attacks, however the links on MSDN don't give me much insight to what exactly the AntiForgeryToken does, or how it works, or why things are done the way they are.

From what I gather, it creates a hash inside a web page and a cookie. One or both of them use the hashed IPrincipal.Name, and use symmetric encryption.

Can anyone shed light as to:

  1. How the AntiForgeryToken works internally
  2. What should it be used to protect
  3. What should it NOT be used to protect
  4. What is the reasoning behind the implementation choices for #1 above?
share|improve this question
    
This is a great question, but I think it belongs on SO. –  SteveS Feb 6 '11 at 17:06
    
Link to S.O. stackoverflow.com/questions/4915430/… –  makerofthings7 Feb 6 '11 at 19:07
add comment

1 Answer

All CSRF is prevented by the use of cryptographic nonce which cannot be obtained by the attacker due to Same-Origin Policy. This is not a problem that Symmetric Cryptography can solve.

Check out the CSRF Prevention Cheat Sheet.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.