Is it possible to make the AntiForgeryToken value in ASP.NET MVC change after each verification?

Question

We've just had some Penetration Testing carried out on an application we've built using ASP.NET MVC, and one of the recommendations that came back was that the value of the AntiForgeryToken in the Form could be resubmitted multiple times and did not expire after a single use.

According to the OWASP recommendations around the Synchronizer Token Pattern:

"In general, developers need only generate this token once for the current session."

Which is how I think the ASP.NET MVC AntiForgeryToken works.

In case we have to fight the battle, is it possible to cause the AntiForgeryToken to regenerate a new value after each validation?

Answer 1

Hi,

Maybe you can use the AntiForgeryToken using the three parameters constructor.

Using a salt is always recommended but also limiting the token by domain and path will make your token more secure and per-page unique.

If you don't have XSS vulnerabilities this problem is not going to be a big mess in your web site :)

Cheers!

Answer 2

The anti-forgery token is just an anti-XSRF token. In particular, it is not a single-use nonce. If you need a single-use nonce for your application, you cannot use the anti-forgery token for this purpose. There is no built-in functionality for this.