ASP.NET Core anti-forgery (CSRF) protection is explicitly disabled

ID

vbnet.misconfiguration.cross_site_request_forgery

Severity

high

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Misconfiguration

Language

VB.NET

Description

Anti-forgery (CSRF) protection is explicitly disabled. Either the <IgnoreAntiforgeryToken> attribute is applied to a controller or action that handles state-changing requests, or the global AutoValidateAntiforgeryToken filter has been removed from the MVC filter pipeline. Without an anti-forgery token, an attacker can trick an authenticated user’s browser into submitting forged state-changing requests. Remove the <IgnoreAntiforgeryToken> attribute (and keep <ValidateAntiForgeryToken> on <HttpPost> actions) or keep the global AutoValidateAntiforgeryToken filter registered.

Rationale

Anti-forgery (CSRF) protection is explicitly disabled. Either the <IgnoreAntiforgeryToken> attribute is applied to a controller or action that handles state-changing requests, or the global AutoValidateAntiforgeryToken filter has been removed from the MVC filter pipeline. Without an anti-forgery token, an attacker can trick an authenticated user’s browser into submitting forged state-changing requests. Remove the <IgnoreAntiforgeryToken> attribute (and keep <ValidateAntiForgeryToken> on <HttpPost> actions) or keep the global AutoValidateAntiforgeryToken filter registered.

The following code illustrates a vulnerable pattern detected by this rule:

Public Class TransferController
    Inherits Controller

    ' VULNERABLE: ASP.NET Core anti-forgery (CSRF) protection is explicitly disabled
    <IgnoreAntiforgeryToken>
    <HttpPost>
    Public Function Transfer(model As TransferModel) As IActionResult
        Return View()
    End Function

Remediation

Follow secure coding practices and review the references below for detailed remediation guidance.

Configuration

This detector does not need any configuration.

References