A look into whether or not antiforgery tokens can be stolen
Antiforgery Tokens
Here are some questions I came up with while learning about antiforgery tokens and how they can protect against CSRF attacks.
You should already know what a CSRF attack is, and what antiforgery tokens are.
Read my article if you’re interested in how antiforgery tokens work behind the scenes.
Login CSRF attack
A login CSRF attack is the opposite of a normal CSRF attack.
The victim loads a fake website which appears real, and uses it to log in to a website like PayPal, but without the victim knowing, the attacker’s credentials are used behind the scenes.
Once the victim logs in, the browser is redirected to the real PayPal website where they’re now logged in as the attacker. …
How antiforgery tokens work in .NET 5.0
In this article I’ll talk about how antiforgery tokens work behind the scenes by answering these questions:
- How does the cookie name get generated?
- How do the cookie and HTML form tokens get generated?
- How are the tokens verified?
You should already know what antiforgery tokens are, and how to use them in Asp.Net Core.
Following along
You can skip this section, however it’s much more interesting to follow along by debugging this yourself.
I won’t show all the code here, however it’s a very simple MVC application which has a form and a button to POST the form.
You can download the code from my GitHub account. …
What is the ideal body type for a Ninja?
I was curious as to what the best body type is in terms of height, weight, BMI and age.
I’ve recorded all the stats for the ninjas whose runs and stats were shown on TV, for season three and four.
Get an understanding of what happens under the hood
This is something that took me a long time to get working, and there is not much help out there on the internet.
So I’m writing this article to give you the help I wish I had when I was trying to work this out.
Why?
Maybe you’re just curious as to how things work behind the scenes, or maybe you’ve found a bug, or need some code you don’t have access to. Whatever your reason is, this article will help you skip all the issues I had.
How?
There are many ways to debug the source code. …
Use Reflection to increase code readability, maintainability, and extensibility
In this article, I’ll show you a scenario where using Reflection can help improve the readability, maintainability, extensibility, and the DRYness of your code.
The Scenario
You’ve written a web app for a car dealership which prints reports about the cars in stock, and what cars have been sold.
Current State Of The Code
Here is what the code looks like at the moment. It’s a simple ASP.NET Core MVC application with one Controller called Home, and two classes for generating the reports.
The CarInfo class generates a report for the cars in stock:
The CarSales class generates a report for the cars that have been…
GET/POST vs PUT/DELETE and CORS
Make sure you’ve read part 1 if you haven’t already.
We’re now going to look at the difference between cross-domain GET/POST and PUT/DELETE requests.
POST Request
To test out what happens when you make a POST request, update Index.cshtml in FakeBank with this code (line 8 and 9 have changed):
Refresh the FakeBank webpage and you’ll notice the Withdraw() action method in GoodBank gets executed.
Look back in the F12 Dev Tools in the FakeBank webpage and you’ll see it’s the same as the GET request. The action method gets executed, but you can’t view the response.
It doesn’t matter that the hacker can’t see the response because he has just sent himself $85 from your account! …
The best way to learn how it works is to do one yourself
This is part 1 of a 2 part series.
I’m going to show you how to simulate a CSRF attack using two local web apps, and then answer a bunch of questions I came up with while I was learning this stuff.
I’ll also talk about CORS and the Same-Origin policy.
The scenario
You’re an internet banking user who is currently logged on to the GoodBank website.
While you’re still logged on, you receive an email pretending to be from GoodBank.
You click the link in the email and it loads the website for FakeBank.
Behind the scenes, the FakeBank website will run Javascript code that makes requests to GoodBank. Because you’re logged in to GoodBank in another tab, the browser will send your session cookie with the malicious requests sent from the FakeBank website. …
How an invisible character can ruin your webpage
Have a look at these two simple HTML pages:
Page 1
Page 2
They look identical, but have a look at what is rendered in the browser:
Page 1 Rendering
Page 2 Rendering
Don’t always believe IntelliSense
Imagine you have this code:
During debug, you decide you want to view some filtered data in the dict.
You’ve included System.Linq and can see the Where() method pop up from IntelliSense.
However, when it executes, you get this error:
About
