ASP.NET CORE MVC – Protect AJAX Requests from CSRF Attempts
This is a follow-up post related to https://blog.eamster.tk/asp-net-mvc-smart-way-to-prevent-cross-site-request-forgery-csrf-attempts-webapi-ajax-xhr-and-normal-post-operations/
I've modified the code from the linked post above so that it works with ASP.NET CORE. Below is the code that can protect all AJAX requests from CSRF (Cross-Site Request Forgery) attempts. For normal <form> POST requests, you should still use and validate against a CSRF token, but if your application is separated into multiple pieces (for example a node.js React front-end application and a .NET CORE based API), this is an easy way to help prevent CSRF attacks without the use of tokens.
using System; using System.Collections.Generic; using System.IO; using System.Linq; using Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Mvc.Filters; using Microsoft.Extensions.Configuration; using Microsoft.Extensions.DependencyInjection; namespace AnalyticsAPI.Filters { public class CSRFAjaxRequestMitigation : IAuthorizationFilter { public void OnAuthorization(AuthorizationFilterContext filterContext) { IServiceProvider services = filterContext.HttpContext.RequestServices; IConfiguration Configuration = services.GetService<IConfiguration>(); string validOrigins = Configuration.GetValue<string>("AllowedEnvironments"); // Example in appsettings.json "AllowedEnvironments": "https://testurl.com:4443,https://testurl.com,https://testurl2.com", bool skipCheck = false; if(Configuration.GetValue<string>("ENVIRONMENT") == "LOCAL") { skipCheck = true; } // In AJAX requests, the origin header is always sent (UNLESS IT'S COMING FROM THE SAME ORIGIN), so we can validate that it comes from a trusted location to prevent CSRF attacks - but if one isn't sent, we won't do anything (assume trusted) // In which case, we don't need to do any token checking either if (!skipCheck && !string.IsNullOrEmpty(validOrigins)) { List<string> validOriginURLs = validOrigins.Split(',').ToList(); if (!string.IsNullOrEmpty(filterContext.HttpContext.Request.Headers["Origin"].ToString())) { string origin = filterContext.HttpContext.Request.Headers["Origin"]; if (!validOriginURLs.Contains(origin, StringComparer.OrdinalIgnoreCase)) { filterContext.Result = new UnauthorizedResult(); } } } } } public class CSRFMitigationAttribute : TypeFilterAttribute { public CSRFMitigationAttribute() : base(typeof(CSRFAjaxRequestMitigation)) { Arguments = new object[] {}; } } }
Rent dedicated game servers from Chicago, Kansas City, Dallas Texas, Wilkes-Barre Pennsylvania, Arizona, Denver Colorado, California, Florida, and Sofia Bulgaria starting as low as $7.45 a month. We Be HostiN (https://webehostin.com)
Tags: ajax, api, asp, asp.net, attack, attacks, attempt, core, cross, csrf, forgery, mvc, protect, request, site, token, xhr