Here are some questions I came up with while learning about antiforgery tokens and how they can protect against CSRF attacks.
You should already know what a CSRF attack is, and what antiforgery tokens are.
Read my article if you’re interested in how antiforgery tokens work behind the scenes.
A login CSRF attack is the opposite of a normal CSRF attack.
The victim loads a fake website which appears real, and uses it to log in to a website like PayPal, but without the victim knowing, the attacker’s credentials are used behind the scenes.
Once the victim logs in, the browser is redirected to the real PayPal website where they’re now logged in as the attacker. …
In this article I’ll talk about how antiforgery tokens work behind the scenes by answering these questions:
You should already know what antiforgery tokens are, and how to use them in Asp.Net Core.
You can skip this section, however it’s much more interesting to follow along by debugging this yourself.
I won’t show all the code here, however it’s a very simple MVC application which has a form and a button to POST the form.
You can download the code from my GitHub account. …
I was curious as to what the best body type is in terms of height, weight, BMI and age.
I’ve recorded all the stats for the ninjas whose runs and stats were shown on TV, for season three and four.
This is something that took me a long time to get working, and there is not much help out there on the internet.
So I’m writing this article to give you the help I wish I had when I was trying to work this out.
Maybe you’re just curious as to how things work behind the scenes, or maybe you’ve found a bug, or need some code you don’t have access to. Whatever your reason is, this article will help you skip all the issues I had.
There are many ways to debug the source code. …
In this article, I’ll show you a scenario where using Reflection can help improve the readability, maintainability, extensibility, and the DRYness of your code.
You’ve written a web app for a car dealership which prints reports about the cars in stock, and what cars have been sold.
Here is what the code looks like at the moment. It’s a simple ASP.NET Core MVC application with one Controller called Home, and two classes for generating the reports.
The CarInfo
class generates a report for the cars in stock:
The CarSales
class generates a report for the cars that have been…
Make sure you’ve read part 1 if you haven’t already.
We’re now going to look at the difference between cross-domain GET/POST and PUT/DELETE requests.
To test out what happens when you make a POST request, update Index.cshtml in FakeBank with this code (line 8 and 9 have changed):
Refresh the FakeBank webpage and you’ll notice the Withdraw()
action method in GoodBank gets executed.
Look back in the F12 Dev Tools in the FakeBank webpage and you’ll see it’s the same as the GET request. The action method gets executed, but you can’t view the response.
It doesn’t matter that the hacker can’t see the response because he has just sent himself $85 from your account! …
This is part 1 of a 2 part series.
I’m going to show you how to simulate a CSRF attack using two local web apps, and then answer a bunch of questions I came up with while I was learning this stuff.
I’ll also talk about CORS and the Same-Origin policy.
You’re an internet banking user who is currently logged on to the GoodBank website.
While you’re still logged on, you receive an email pretending to be from GoodBank.
You click the link in the email and it loads the website for FakeBank.
Behind the scenes, the FakeBank website will run Javascript code that makes requests to GoodBank. Because you’re logged in to GoodBank in another tab, the browser will send your session cookie with the malicious requests sent from the FakeBank website. …
How an invisible character can ruin your webpage
Have a look at these two simple HTML pages:
They look identical, but have a look at what is rendered in the browser:
Imagine you have this code:
During debug, you decide you want to view some filtered data in the dict
.
You’ve included System.Linq
and can see the Where()
method pop up from IntelliSense.
However, when it executes, you get this error:
About