What is for the Html.AntiForgeryToken helper function?

Question

Can somebody tell me more details about it?

Answer 1

In general, the anti-forgery-token is an HTML hidden input that that's rendered for you to avoid CSRF attacks. Broadly, it works by comparing the value that the server sent down to the client to what the client sends back on the post. Is that all you're looking for?

You should probably check out MSDN for more details.

Answer 2

Using AntiForgeryToken helps mitigate against cross-site request forgery attacks.

When you use it, your form will contain a hidden field and a corresponding cookie will also be set in the browser.

Then, when the form is submitted, the hidden field is checked against the cookie value (assuming that ValidateAntiForgeryTokenAttribute is used): if the field and the cookie match then the form post is probably genuine; if they don't then it's probably not. (An attacker attempting a CSRF attack might be able to forge the hidden field, but they shouldn't be able to also forge the corresponding cookie value.)

Answer 3

Basically the anti forgery tokens stop anyone from submitting requests to your site that are generated by a malicious script not generated by the actual user. There is an HTTP only cookie (not readable by a script running in the browser, but sent by the browser and accessible by the server) that gets sent to the client, it is used to generate a hidden field value which is then validated against the cookie. At least I think that's the process.

There is a good description of this here which is exactly what you are asking about http://msmvps.com/blogs/luisabreu/archive/2009/02/09/the-mvc-platform-the-new-anti-forgery-token.aspx