Is it possible to make the AntiForgeryToken value in ASP.NET MVC change after each verification?

Posted by jmcd on Stack Overflow See other posts from Stack Overflow or by jmcd
Published on 2010-02-08T09:51:28Z Indexed on 2010/04/23 16:53 UTC
Read the original article Hit count: 502

Filed under:

asp.net-mvc

|

antiforgerytoken

|

web-security

We've just had some Penetration Testing carried out on an application we've built using ASP.NET MVC, and one of the recommendations that came back was that the value of the AntiForgeryToken in the Form could be resubmitted multiple times and did not expire after a single use.

According to the OWASP recommendations around the Synchronizer Token Pattern:

"In general, developers need only generate this token once for the current session."

Which is how I think the ASP.NET MVC AntiForgeryToken works.

In case we have to fight the battle, is it possible to cause the AntiForgeryToken to regenerate a new value after each validation?

© Stack Overflow or respective owner

Related posts about asp.net-mvc

Migrating ASP.NET MVC 1.0 applications to ASP.NET MVC 2 RTM

as seen on ASP.net Weblogs - Search for 'ASP.net Weblogs'
Note: ASP.NET MVC 2 RTM isn’t yet released! But this tool will help you get your ASP.NET MVC 1.0 applications ready for when it is! I have updated the MVC App Converter to convert projects from ASP.NET MVC 1.0 to ASP.NET MVC 2 RTM. This should be last the last major change to the MVC App Converter… >>> More
ASP.NET MVC 3 Hosting :: New Features in ASP.NET MVC 3

as seen on Geeks with Blogs - Search for 'Geeks with Blogs'
Razor View Engine The Razor view engine is a new view engine option for ASP.NET MVC that supports the Razor templating syntax. The Razor syntax is a streamlined approach to HTML templating designed with the goal of being a code driven minimalist templating approach that builds on existing C#, VB… >>> More
PathTooLongException after migrating from ASP.NET MVC 1 to ASP.NET MVC 2

as seen on Stack Overflow - Search for 'Stack Overflow'
I had updated my app from MVC 1 to MVC 2. After that some pages throws PathTooLongException: [PathTooLongException: The specified path, file name, or both are too long. The fully qualified file name must be less than 260 characters, and the directory name must be less than 248 characters.] … >>> More
Differece between Asp.net MVC 1 and Asp.net MVC 2

as seen on Stack Overflow - Search for 'Stack Overflow'
what is differece between Asp.net MVC 1 and Asp.net MVC 2? >>> More
Top 5 reasons for using ASP.NET MVC 2 rather than ASP.NET MVC 1

as seen on Stack Overflow - Search for 'Stack Overflow'
I've been using ASP.NET MVC 1 for a while now, and am keen to take advantage of the improvements in MVC 2. Things like validation seem greatly improved, and strongly-typed HTML helper methods look great. So, for those of you who have real-world practical experience of using ASP.NET MVC 1 and are… >>> More

Related posts about antiforgerytoken

Beware: Upgrade to ASP.NET MVC 2.0 with care if you use AntiForgeryToken

as seen on ASP.net Weblogs - Search for 'ASP.net Weblogs'
If you're thinking of upgrading to MVC 2.0, and you take advantage of the AntiForgeryToken support then be careful - you can easily kick out all active visitors after the upgrade until they restart their browser. Why's this?For the anti forgery validation to take place, ASP.NET MVC uses a session… >>> More
MVC 2 AntiForgeryToken - Why symmetric encryption + IPrinciple?

as seen on Stack Overflow - Search for 'Stack Overflow'
We recently updated our solution to MVC 2, and this has updated the way that the AntiForgeryToken works. Unfortunately this does not fit with our AJAX framework any more. The problem is that MVC 2 now uses symmetric encryption to encode some properties about the user, including the user's Name property… >>> More
Dynamic Forms and AntiForgeryToken MVC

as seen on Stack Overflow - Search for 'Stack Overflow'
Hi ALL, I want to create dynamic forms on a MVC page that will generate something like this. onclick="var f = document.createElement('form'); f.style.display = 'none'; this.parentNode.appendChild(f); f.method = 'POST'; f.action = this.href;var s = document.createElement('input'); s.setAttribute('type'… >>> More
Is it possible to make the AntiForgeryToken value in ASP.NET MVC change after each verification?

as seen on Stack Overflow - Search for 'Stack Overflow'
We've just had some Penetration Testing carried out on an application we've built using ASP.NET MVC, and one of the recommendations that came back was that the value of the AntiForgeryToken in the Form could be resubmitted multiple times and did not expire after a single use. According to the OWASP… >>> More
Problem with Validate Anti Forgery

as seen on Stack Overflow - Search for 'Stack Overflow'
Hi! I have a problem regarding MVC Anti forgery token. When I do my authentication I have pseudo code like this: var user = userRepository.GetByEmail(email); System.Threading.Thread.CurrentPrincipal = HttpContext.Current.User = user; by doing so I'm able to get the current user in my code like… >>> More