What is the use of @Html.AntiForgeryToken()?

asp.net Mvchtml.beginform

asp.net Mvc Problem Overview


Why we need to use @Html.AntiForgeryToken()? I searched but I didn't get satisfactory answer.

asp.net Mvc Solutions


Solution 1 - asp.net Mvc

This is a security feature to help protect your application against cross-site request forgery.

Example:

Let's assume you have a register functionality in your web app. You have an AccountController (example.com/account/register) where you expect people to submit their info. Normally before someone posts the registration information needs to visit the actual (example.com/account/register) than submit the form.

Let say I am a bad guy and I want to flood your server with junk info all I need to do is just keep posting directly to (example.com/account/register) without visiting your site. So in order to stop me you implement AntiForgeryToken so you can make it sure I visited the page before I submitted the registration information.

Another example is http://www.binaryintellect.net/articles/20e546b4-3ae9-416b-878e-5b12434fe7a6.aspx.

Solution 2 - asp.net Mvc

This is to prevent Cross-site request forgery in your MVC application. This is part of the OWASP Top 10 and it is vital in terms of web security. Using the @Html.AntiforgeryToken() method will generate a token per every request so then no one can forge a form post.

Solution 3 - asp.net Mvc

What is the use of @Html.AntiForgeryToken()?

Live - Scenario :

Suppose, you are logged into your bank account and are going to transfer some money to your friend. A hacker knows that you are logged in and also knows the URL of the money transfer submission. Suddenly, you get an email and check it. You see an image and by mistake, you click on that. Then, after a minute or so, you get another message that some amount has been deducted from your account. Actually, that image had been sent by the hacker and behind that image a URL has been submitted on your click.

So that we use AntiForgeryToken() in application prevent from hackers.

Solution 4 - asp.net Mvc

Antiforgery() is for stopping robotic fill up of any forms. Which will stop adding data without getting into the form

Attributions

All content for this solution is sourced from the original question on Stackoverflow.

The content on this page is licensed under the Attribution-ShareAlike 4.0 International (CC BY-SA 4.0) license.

Content TypeOriginal AuthorOriginal Content on Stackoverflow
QuestionMhdView Question on Stackoverflow
Solution 1 - asp.net MvcDynamikusView Answer on Stackoverflow
Solution 2 - asp.net MvcJordi CorbillaView Answer on Stackoverflow
Solution 3 - asp.net MvcArun Kumar TiwariView Answer on Stackoverflow
Solution 4 - asp.net MvcrazView Answer on Stackoverflow