ASP.NET MVC Anti Forgery Token不安全

我实际上可以在没有ssl的情况下向服务器发出请求时以纯文本形式看到MVC3框架生成的验证令牌密钥.

此密钥存储在名为:_RequestVerificationToken_Lw__的cookie中

在混合安全环境中,实际上可以在对非ssl站点的初始请求中以明文形式看到此令牌发送到服务器.此令牌在用户会话期间也是静态的.那么当攻击者很容易被盗时,使用这个令牌会有什么用处,因为cookie会以纯文本形式被抛出.

这个cookie不应该标记为安全,永远不会以纯文本形式发送吗？或者至少在每个请求上重新生成,以便安全信息不会泄漏出ssl通道？

我在谈论MVC 3 AntiForgeryWorker类中的这个块

private string GetAntiForgeryTokenAndSetCookie(HttpContextBase httpContext, string salt, string domain, string path)
{
  string forgeryTokenName = AntiForgeryData.GetAntiForgeryTokenName(httpContext.Request.ApplicationPath);
  AntiForgeryData token = (AntiForgeryData) null;
  HttpCookie httpCookie = httpContext.Request.Cookies[forgeryTokenName];
  if (httpCookie != null)
  {
    try
    {
      token = this.Serializer.Deserialize(httpCookie.Value);
    }
    catch (HttpAntiForgeryException ex)
    {
    }
  }
  if (token == null)
  {
    token = AntiForgeryData.NewToken();
    string str = this.Serializer.Serialize(token);
    HttpCookie cookie = new HttpCookie(forgeryTokenName, str)
    {
      HttpOnly = true,
      Domain = domain
    };
    if (!string.IsNullOrEmpty(path))
      cookie.Path = path;
    httpContext.Response.Cookies.Set(cookie); //Ma, Why isn't this marked as "SECURE"
  }
  return this.Serializer.Serialize(new AntiForgeryData(token)
  {
    Salt = salt,
    Username = AntiForgeryData.GetUsername(httpContext.User)
  });
}

Levi.. 25

That's quite the inflammatory question title you have there.

The built-in MVC anti-forgery functionality is as secure as the application is configured to be. All cookies written to Response.Cookies will be automatically marked with the "secure" modifier if is set in Web.config (see MSDN docs). MVC's anti-forgery cookie also gets this behavior if this switch is set.

Combine this with other functionality like setting the HSTS header in your responses, and you're essentially providing a guarantee that the browser will never send sensitive data over plaintext channels.

Additionally, the anti-forgery system does allow storing custom data in the tokens, and you can receive a callback to verify the custom data when the token is validated. See AntiForgeryConfig.AdditionalDataProvider for more information.

许多年前,SSL曾经很昂贵.这已不再是这种情况.完全SSL站点现在具有与混合安全站点相同的性能特征.不过,您可以设置anti-xsrf cookie的"安全"标志,而无需使用AntiForgeryConfig.RequireSSL属性选择所有内容:请参阅http://msdn.microsoft.com/en-us/library/system.web.helpers .antiforgeryconfig.requiressl(v = vs.111).aspx了解更多信息. (3认同)

NathanAldenS.. 9

通过防止CSRF攻击,最佳解决方案是始终使用SSL.没有SSL,是的,nonce - 它被称为 - 容易受到MITM攻击.使用cookie存储nonce时,cookie 必须标记为仅HTTP.这可以防止JavaScript读取cookie.除了cookie之外,您还应该将nonce渲染为所有