full-disclosure - Re: [WEB SECURITY] Preventing Cross-site Request Forgeries [ASP.NET crowd]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <006a01c77318$62071870$712d379d@redmond.corp.microsoft.com>
Date: Fri, 30 Mar 2007 15:11:36 -0700
From: "Chris Weber" <chris@...kout.net>
To: "'pdp \(architect\)'" <pdp.gnucitizen@...glemail.com>,
	<full-disclosure@...ts.grok.org.uk>,
	"'WASC Forum'" <websecurity@...appsec.org>,
	"'webappsec @OWASP'" <webappsec@...ts.owasp.org>
Subject: Re: [WEB SECURITY] Preventing Cross-site Request
	Forgeries [ASP.NET crowd]

Nice article.  

For the ASP.NET crowd out there, the will be even more simple, one line of
code.  Set the ViewStateUserKey property in your base class or page and the
unique token protections (similar to CSRF_Guard) will be provided for you.

http://msdn2.microsoft.com/en-us/library/system.web.ui.page.viewstateuserkey
.aspx

This protection mechanism has been available for many years, since the
Framework 1.1

-----Original Message-----
From: pdp (architect) [mailto:pdp.gnucitizen@...glemail.com] 
Sent: Friday, March 30, 2007 3:16 AM
To: full-disclosure@...ts.grok.org.uk; WASC Forum; webappsec @OWASP
Subject: [WEB SECURITY] Preventing Cross-site Request Forgeries

http://www.gnucitizen.org/blog/preventing-csrf

I briefly covered how simple it is to prevent CSRF attacks. Hope that you
find it useful.

--
pdp (architect) | petko d. petkov
http://www.gnucitizen.org

----------------------------------------------------------------------------
Join us on IRC: irc.freenode.net #webappsec

Have a question? Search The Web Security Mailing List Archives: 
http://www.webappsec.org/lists/websecurity/

Subscribe via RSS: 
http://www.webappsec.org/rss/websecurity.rss [RSS Feed]

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/