16f6c0aecf
Inline adoc files when they are included exactly once. Also fix language tags because this inlining gives us better information on what language the code is written in.
77 lines
1.9 KiB
Plaintext
77 lines
1.9 KiB
Plaintext
include::../description.adoc[]
|
||
|
||
include::../ask-yourself.adoc[]
|
||
|
||
include::../recommended.adoc[]
|
||
|
||
== Sensitive Code Example
|
||
|
||
[source,csharp]
|
||
----
|
||
public void ConfigureServices(IServiceCollection services)
|
||
{
|
||
// ...
|
||
services.AddControllersWithViews(options => options.Filters.Add(new IgnoreAntiforgeryTokenAttribute())); // Sensitive
|
||
// ...
|
||
}
|
||
----
|
||
|
||
[source,csharp]
|
||
----
|
||
[HttpPost, IgnoreAntiforgeryToken] // Sensitive
|
||
public IActionResult ChangeEmail(ChangeEmailModel model) => View("~/Views/...");
|
||
----
|
||
|
||
== Compliant Solution
|
||
|
||
[source,csharp]
|
||
----
|
||
public void ConfigureServices(IServiceCollection services)
|
||
{
|
||
// ...
|
||
services.AddControllersWithViews(options => options.Filters.Add(new AutoValidateAntiforgeryTokenAttribute()));
|
||
// or
|
||
services.AddControllersWithViews(options => options.Filters.Add(new ValidateAntiForgeryTokenAttribute()));
|
||
// ...
|
||
}
|
||
----
|
||
|
||
[source,csharp]
|
||
----
|
||
[HttpPost]
|
||
[AutoValidateAntiforgeryToken]
|
||
public IActionResult ChangeEmail(ChangeEmailModel model) => View("~/Views/...");
|
||
----
|
||
|
||
include::../see.adoc[]
|
||
|
||
ifdef::env-github,rspecator-view[]
|
||
|
||
'''
|
||
== Implementation Specification
|
||
(visible only on this page)
|
||
|
||
include::../message.adoc[]
|
||
|
||
'''
|
||
== Comments And Links
|
||
(visible only on this page)
|
||
|
||
=== on 29 Jan 2021, 11:07:02 Costin Zaharia wrote:
|
||
https://docs.microsoft.com/en-us/aspnet/core/security/anti-request-forgery?view=aspnetcore-5.0[Configuring Cross-site request forgery protection in ASP.NET Code MVC]
|
||
|
||
=== on 12 Apr 2021, 13:13:42 Costin Zaharia wrote:
|
||
Nice catch! Searching for *asp-antiforgery* inside *.cshtml file would be great.
|
||
|
||
=== on 12 Apr 2021, 13:31:00 Andrei Epure wrote:
|
||
And also :
|
||
|
||
* opted-out of Tag Helpers
|
||
* removing the ``++FormTagHelper++`` from the view
|
||
|
||
https://docs.microsoft.com/en-us/aspnet/core/security/anti-request-forgery?view=aspnetcore-5.0[Configuring Cross-site request forgery protection in ASP.NET Code MVC]
|
||
|
||
include::../comments-and-links.adoc[]
|
||
|
||
endif::env-github,rspecator-view[]
|