Generating AntiForgeryToken in WebForms

Question

I have a .NET Webforms site thanks needs to post to my MVC Application which currently sits inside the Webform site as a separate application.

The Webform application need to POST some sensitive values to the MVC Application.

Is there a way to generate a AntiForgeryToken() in my WebForms Application so it can be passed with the form post.

Otherwise does anyone know of any other custom anti forgery code that will allow me to do something similar to the MVC's AntiForgeryValidation.

Answer 1

Implementing it yourself is not too difficult.

• Generate a GUID
• Put it in a hidden field
• Also put it in Session or Cookie (in the latter case, with some anti-tamper protection)
• At the start of processing the form compare the field and store token.

(If you look at the implementation of MVC, there is very little more to it. A few helper methods is all you need.)

Answer 2

WebForms has a pretty similar analog in Page.ViewStateUserKey. By setting that to a per-user value (most choose HttpSessionState.SessionId), WebForms will validate the ViewState¹ as part of the MAC check.

 overrides OnInit(EventArgs e) {
     base.OnInit(e);
     ViewStateUserKey = Session.SessionId;
 }

¹ There are scenarios where ViewStateUserKey will not help. Mainly, they boil down to doing dangerous things with GET requests (or in Page_Load without checking IsPostback), or disabling ViewStateMAC.

Answer 3

You can use reflection to get at the MVC methods used to set the cookie and matching form input used for the MVC validation. That way you can have an MVC action with [AcceptVerbs(HttpVerbs.Post), ValidateAntiForgeryToken] attributes that you can post to from a WebForms generated page.

See this answer: http://stackoverflow.com/questions/1347728/using-an-mvc-htmlhelper-from-a-webform/2553583#2553583