In this article I’ll talk about what values an antiforgery token can take on in .NET 5.0.

You should already have a basic understanding of antiforgery tokens and how to use them in .NET 5.0.

The First 26 Characters

If you’ve read my first article on antiforgery tokens, you’ll know that out of the 155 characters that make up the token, the first 5 characters are always the same:

CfDJ8

This is because these hard-coded eight bytes are always written to the start of the array before being base64 encoded:

0x09F0C9F0

The next 21 characters will always be the same for your application depending…

Antiforgery Tokens

Here are some questions I came up with while learning about antiforgery tokens and how they can protect against CSRF attacks.

You should already know what a CSRF attack is, and what antiforgery tokens are.

Read my article if you’re interested in how antiforgery tokens work behind the scenes.

Login CSRF attack

A login CSRF attack is the opposite of a normal CSRF attack.

The victim loads a fake website which appears real, and uses it to log in to a website like PayPal, but without the victim knowing, the attacker’s credentials are used behind the scenes.

Once the victim logs in, the…

In this article I’ll talk about how antiforgery tokens work behind the scenes by answering these questions:

1. How does the cookie name get generated?
2. How do the cookie and HTML form tokens get generated?
3. How are the tokens verified?

You should already know what antiforgery tokens are, and how to use them in Asp.Net Core.

Following along

You can skip this section, however it’s much more interesting to follow along by debugging this yourself.

I won’t show all the code here, however it’s a very simple MVC application which has a form and a button to POST the form.

You can download…

I was curious as to what the best body type is in terms of height, weight, BMI and age.

I’ve recorded all the stats for the ninjas whose runs and stats were shown on TV, for season three and four.

This is something that took me a long time to get working, and there is not much help out there on the internet.

So I’m writing this article to give you the help I wish I had when I was trying to work this out.

Why?

Maybe you’re just curious as to how things work behind the scenes, or maybe you’ve found a bug, or need some code you don’t have access to. Whatever your reason is, this article will help you skip all the issues I had.

How?

There are many ways to debug the source code. …

In this article, I’ll show you a scenario where using Reflection can help improve the readability, maintainability, extensibility, and the DRYness of your code.

The Scenario

You’ve written a web app for a car dealership which prints reports about the cars in stock, and what cars have been sold.

Current State Of The Code

Here is what the code looks like at the moment. It’s a simple ASP.NET Core MVC application with one Controller called Home, and two classes for generating the reports.

The CarInfo class generates a report for the cars in stock:

The CarSales class generates a report for the cars that have…

Make sure you’ve read part 1 if you haven’t already.

We’re now going to look at the difference between cross-domain GET/POST and PUT/DELETE requests.

POST Request

To test out what happens when you make a POST request, update Index.cshtml in FakeBank with this code (line 8 and 9 have changed):

Refresh the FakeBank webpage and you’ll notice the Withdraw() action method in GoodBank gets executed.

Look back in the F12 Dev Tools in the FakeBank webpage and you’ll see it’s the same as the GET request. The action method gets executed, but you can’t view the response.

It doesn’t matter that…

This is part 1 of a 2 part series.

I’m going to show you how to simulate a CSRF attack using two local web apps, and then answer a bunch of questions I came up with while I was learning this stuff.

I’ll also talk about CORS and the Same-Origin policy.

The scenario

You’re an internet banking user who is currently logged on to the GoodBank website.

While you’re still logged on, you receive an email pretending to be from GoodBank.

You click the link in the email and it loads the website for FakeBank.

Behind the scenes, the FakeBank website will…