Tagged Questions

1
vote
2answers
643 views

How does ViewState protect against CSRF?

According to the OWASP CSRF Cheat Sheet viewStateUserKey for ASP.NET ViewState is acceptable to prevent csrf attacks, but I really don't get how. I get that this makes it hard for an attacker to ...
10
votes
3answers
1k views

What risks do Cookieless sessions have? What are the mitigations?

I'm debating if I should support cookieless sessions in my web app. It would look something like this: http://www.example.com/(S(lit3py55t21z5v55vlm25s55))/orderform.aspx Since the URL is never ...
7
votes
3answers
3k views

Does ASP.NET Viewstate implicitly prevent CSRF attacks? What does this mean for MVC?

If an encrypted ASP.NET Viewstate is submitted with every form, and control POST, does that mean that ASP.NET is less vulnerable to CSRF than other solutions with this? What is the extent and ...
15
votes
2answers
2k views

When the use of a AntiForgeryToken is not required /needed?

I'm running a rather large site with thousands of visits every day, and a rather large userbase. Since I started migrating to MVC 3, I've been putting the AntiForgeryToken in a number of forms, that ...