0
유효성 확인 방법 CSRF 토큰 (아약스 요청시) site.master 페이지에 몇 가지 코드를 추가했습니다. asp.net webforms CSRF 토큰 유효성 검사 방법
private const string AntiXsrfTokenKey = "__AntiXsrfToken";
private const string AntiXsrfUserNameKey = "__AntiXsrfUserName";
private string _antiXsrfTokenValue;
protected void Page_Init(object sender, EventArgs e)
{
if (!Request.Url.AbsolutePath.Contains("HtmlRender.aspx"))
{
//First, check for the existence of the Anti-XSS cookie
var requestCookie = Request.Cookies[AntiXsrfTokenKey];
Int32 requestCookieGuidValue;
//If the CSRF cookie is found, parse the token from the cookie.
//Then, set the global page variable and view state user
//key. The global variable will be used to validate that it matches
//in the view state form field in the Page.PreLoad method.
if (requestCookie != null
&& Int32.TryParse(requestCookie.Value, out requestCookieGuidValue))
{
//Set the global token variable so the cookie value can be
//validated against the value in the view state form field in
//the Page.PreLoad method.
_antiXsrfTokenValue = requestCookie.Value;
//Set the view state user key, which will be validated by the
//framework during each request
Page.ViewStateUserKey = _antiXsrfTokenValue;
}
//If the CSRF cookie is not found, then this is a new session.
else
{
//Generate a new Anti-XSRF token
_antiXsrfTokenValue = Guid.NewGuid().ToString("N");
//Set the view state user key, which will be validated by the
//framework during each request
Page.ViewStateUserKey = _antiXsrfTokenValue;
//Create the non-persistent CSRF cookie
var responseCookie = new HttpCookie(AntiXsrfTokenKey)
{
//Set the HttpOnly property to prevent the cookie from
//being accessed by client side script
HttpOnly = true,
//Add the Anti-XSRF token to the cookie value
Value = _antiXsrfTokenValue
};
//If we are using SSL, the cookie should be set to secure to
//prevent it from being sent over HTTP connections
if (FormsAuthentication.RequireSSL &&
Request.IsSecureConnection)
{
responseCookie.Secure = true;
}
//Add the CSRF cookie to the response
Response.Cookies.Set(responseCookie);
}
Page.PreLoad += master_Page_PreLoad;
}
}
protected void master_Page_PreLoad(object sender, EventArgs e)
{
//During the initial page load, add the Anti-XSRF token and user
//name to the ViewState
if (!IsPostBack)
{
//Set Anti-XSRF token
ViewState[AntiXsrfTokenKey] = Page.ViewStateUserKey;
//If a user name is assigned, set the user name
ViewState[AntiXsrfUserNameKey] =
Context.User.Identity.Name ?? String.Empty;
}
//During all subsequent post backs to the page, the token value from
//the cookie should be validated against the token in the view state
//form field. Additionally user name should be compared to the
//authenticated users name
else
{
//Validate the Anti-XSRF token
if ((string)ViewState[AntiXsrfTokenKey] != _antiXsrfTokenValue
|| (string)ViewState[AntiXsrfUserNameKey] !=
(Context.User.Identity.Name ?? String.Empty))
{
throw new InvalidOperationException("Validation of " +
"Anti-XSRF token failed.");
}
}
}
내가 마스터 페이지를 사용하지 않는 버튼 save.aspx 저장을 클릭
Cookie:ASP.NET_SessionId=luzxp1452vhz133aqzp4apyg; __AntiXsrfToken=9df60e2882254df58e24093b65a4fccb
쿠키
에서 설정 아래function save_data(AJAX, save_fun) {
var sPath = window.location.pathname;
sPath = sPath.substring(sPath.lastIndexOf('/') + 1);
AJAX.addData('PageName', sPath);
AJAX.action = 'C'; ///Custom
AJAX.showProgress(true);
AJAX.addHeaderAction(AJAX.action);
AJAX.createXMLreq();
AJAX.xmlhttp = AJAX.getAjaxObject();
AJAX.xmlhttp.onreadystatechange = function() {
if (AJAX.xmlhttp.readyState == 4 && AJAX.xmlhttp.status == 200) {
AJAX.resXML = AJAX.xmlhttp;
} else {
AJAX.showProgress(true);
}
}
AJAX.xmlhttp.open("POST", "save.aspx", true);
AJAX.xmlhttp.send(AJAX.reqXML);
}