Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm wondering about the best way to protect against CSRF in MVC or any other stateless web app. Due to the stateless nature, we can not keep a secret token in the session and compare it to the secret that accepted form client afterwards. My question is - how can we prevent a malicious user from attacking by CSRF? Note that i'm not seeking for a specific implementation info such as "use AntiForgeryToken()". Any related information will be helpful. Thanks a lot.

share|improve this question
2  
if the app was totally stateless then I don't think a CSRF would be possible. So... there must be a session state being recorded somewhere. If it's a java-based app then you'd naturally use the HttpSession. –  Callum Wilson Mar 7 '13 at 12:28
add comment

1 Answer

in MVC or any other stateless web app

Your terminology is rather confused. Any user facing application is a hierarchy of MVC patterns. MVC is rarely stateless, indeed in the cases where it is stateless (serverside) there's very little risk from CSRF. Your question is really about session management.

In the absence of session management, the only way I know of to solve the problem is via OTPs - but arguably this is session management since the OTP must be retained until it used, and the information about the OTP modified when it is used.

If you consider the case for pay-per-click advertising - you're not relying on any information being supplied by the user, however you do need to keep track of counts - hence the application is no loinger stateless. You can avoid the need to maintain a session by using (for example) browser fingerprinting - but you then need to maintain a list (state) of fingerprints already considered to have 'clicked' - the application is no longer stateless with regard to the client device and there is a session. It's really not that different from dropping a cookie on the browser and reading it back later.

Given that it also solves many other problems, maintaining a session serverside is the best solution.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.