full-disclosure - Re: [WEB SECURITY] Preventing Cross-site Request Forgeries [ASP.NET crowd]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <006601c77343$43036ed0$020ba8c0@redmond.corp.microsoft.com>
Date: Fri, 30 Mar 2007 20:18:29 -0700
From: "Chris Weber" <chris@...kout.net>
To: "'Michael Sutton'" <msutton@...dynamics.com>,
	"'pdp \(architect\)'" <pdp.gnucitizen@...glemail.com>,
	<full-disclosure@...ts.grok.org.uk>,
	"'WASC Forum'" <websecurity@...appsec.org>,
	"'webappsec @OWASP'" <webappsec@...ts.owasp.org>
Subject: Re: [WEB SECURITY] Preventing Cross-site Request
	Forgeries [ASP.NET crowd]

Actually that's not true.  We should be clear that this is *not* the same
thing as ViewStateUserKey (which is not enabled by default).
EnableEventValidation does provide postback input related protections, but
ViewStateUserKey actually ties it to the user session.  Without
ViewStateUserKey, you will notice the __EVENTVALIDATION nonce will be the
same for any two users.  With ViewStateUserKey, the value will be unique per
user.



-----Original Message-----
From: Michael Sutton [mailto:msutton@...dynamics.com] 
Sent: Friday, March 30, 2007 3:59 PM
To: Chris Weber; pdp (architect); full-disclosure@...ts.grok.org.uk; WASC
Forum; webappsec @OWASP
Subject: RE: [WEB SECURITY] Preventing Cross-site Request Forgeries [ASP.NET
crowd]

The EnableEventValidation page directive (enabled by default since .Net
2.0) applies a nonce value for form validation and is also a strong control
to prevent CSRF attacks. 

Michael Sutton
Security Evangelist
SPI Dynamics
http://portal.spidynamics.com/blogs/msutton

> -----Original Message-----
> From: Chris Weber [mailto:chris@...kout.net]
> Sent: Friday, March 30, 2007 6:12 PM
> To: 'pdp (architect)'; full-disclosure@...ts.grok.org.uk; 'WASC
Forum';
> 'webappsec @OWASP'
> Subject: RE: [WEB SECURITY] Preventing Cross-site Request Forgeries 
> [ASP.NET crowd]
> 
> Nice article.
> 
> For the ASP.NET crowd out there, the will be even more simple, one
line of
> code.  Set the ViewStateUserKey property in your base class or page
and
> the
> unique token protections (similar to CSRF_Guard) will be provided for
you.
> 
> http://msdn2.microsoft.com/en-
> us/library/system.web.ui.page.viewstateuserkey
> .aspx
> 
> This protection mechanism has been available for many years, since the 
> Framework 1.1
> 
> 
> 
> 
> 
> -----Original Message-----
> From: pdp (architect) [mailto:pdp.gnucitizen@...glemail.com]
> Sent: Friday, March 30, 2007 3:16 AM
> To: full-disclosure@...ts.grok.org.uk; WASC Forum; webappsec @OWASP
> Subject: [WEB SECURITY] Preventing Cross-site Request Forgeries
> 
> http://www.gnucitizen.org/blog/preventing-csrf
> 
> I briefly covered how simple it is to prevent CSRF attacks. Hope that
you
> find it useful.
> 
> --
> pdp (architect) | petko d. petkov
> http://www.gnucitizen.org
> 
>
------------------------------------------------------------------------
--
> --
> Join us on IRC: irc.freenode.net #webappsec
> 
> Have a question? Search The Web Security Mailing List Archives:
> http://www.webappsec.org/lists/websecurity/
> 
> Subscribe via RSS:
> http://www.webappsec.org/rss/websecurity.rss [RSS Feed]
> 
> 
>
------------------------------------------------------------------------
--
> --
> Join us on IRC: irc.freenode.net #webappsec
> 
> Have a question? Search The Web Security Mailing List Archives:
> http://www.webappsec.org/lists/websecurity/
> 
> Subscribe via RSS:
> http://www.webappsec.org/rss/websecurity.rss [RSS Feed]

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/