ValidateAntiForgeryToken的用途，解释和示例

本文翻译自：ValidateAntiForgeryToken purpose, explanation and example

Could you explain ValidateAntiForgeryToken purpose and show me example about ValidateAntiForgeryToken in MVC 4? 您能否解释ValidateAntiForgeryToken的用途，并向我展示有关MVC 4中ValidateAntiForgeryToken示例？

I could not find any examples which explain this attribute? 我找不到解释此属性的任何示例？

---

#1楼

参考：https://stackoom.com/question/v9gc/ValidateAntiForgeryToken的用途-解释和示例

---

#2楼

MVC's anti-forgery support writes a unique value to an HTTP-only cookie and then the same value is written to the form. MVC的防伪支持将唯一值写入仅HTTP的cookie，然后将相同的值写入表单。 When the page is submitted, an error is raised if the cookie value doesn't match the form value. 提交页面后，如果Cookie值与表单值不匹配，则会引发错误。

It's important to note that the feature prevents cross site request forgeries . 请务必注意，该功能可防止跨站点请求伪造 。 That is, a form from another site that posts to your site in an attempt to submit hidden content using an authenticated user's credentials. 也就是说，来自另一个站点的表单会发布到您的站点，以尝试使用经过身份验证的用户的凭据提交隐藏的内容。 The attack involves tricking the logged in user into submitting a form, or by simply programmatically triggering a form when the page loads. 攻击包括诱使已登录的用户提交表单，或者仅在页面加载时以编程方式触发表单。

The feature doesn't prevent any other type of data forgery or tampering based attacks. 该功能不会阻止任何其他类型的数据伪造或基于篡改的攻击。

To use it, decorate the action method or controller with the ValidateAntiForgeryToken attribute and place a call to @Html.AntiForgeryToken() in the forms posting to the method. 要使用它，请用ValidateAntiForgeryToken属性装饰动作方法或控制器，并在张贴到方法的表单中调用@Html.AntiForgeryToken() 。

---

#3楼

The basic purpose of ValidateAntiForgeryToken attribute is to prevent cross-site request forgery attacks. ValidateAntiForgeryToken属性的基本目的是防止跨站点请求伪造攻击。

A cross-site request forgery is an attack in which a harmful script element, malicious command, or code is sent from the browser of a trusted user. 跨站点请求伪造是一种攻击，其中从受信任用户的浏览器发送有害脚本元素，恶意命令或代码。 For more information on this please visit http://www.asp.net/mvc/overview/security/xsrfcsrf-prevention-in-aspnet-mvc-and-web-pages . 有关此的更多信息，请访问http://www.asp.net/mvc/overview/security/xsrfcsrf-prevention-in-aspnet-mvc-and-web-pages 。

It is simple to use, you need to decorate method with ValidateAntiForgeryToken attribute as below: 它使用简单，您需要使用ValidateAntiForgeryToken属性装饰方法，如下所示：

[HttpPost]  
[ValidateAntiForgeryToken]  
public ActionResult CreateProduct(Product product)  
{
  if (ModelState.IsValid)  
  {
    //your logic 
  }
  return View(ModelName);
}

It is derived from System.Web.Mvc namespace. 它派生自System.Web.Mvc命名空间。

And in your view, add this code to add the token so it is used to validate the form upon submission. 在您看来，添加此代码以添加令牌，以便在提交时用于验证表单。

@Html.AntiForgeryToken()

---

#4楼

Microsoft provides us built-in functionality which we use in our application for security purposes, so no one can hack our site or invade some critical information. Microsoft提供了内置功能，出于安全目的，我们在应用程序中使用了这些内置功能，因此没有人可以入侵我们的网站或入侵某些关键信息。

From Purpose Of ValidateAntiForgeryToken In MVC Application by Harpreet Singh: 来自 Harpreet Singh的MVC应用程序中ValidateAntiForgeryToken的用途 ：

Use of ValidateAntiForgeryToken ValidateAntiForgeryToken的使用

Let's try with a simple example to understand this concept. 让我们尝试一个简单的例子来理解这个概念。 I do not want to make it too complicated, that's why I am going to use a template of an MVC application, already available in Visual Studio. 我不想使其变得太复杂，这就是为什么我要使用Visual Studio中已经可用的MVC应用程序的模板的原因。 We will do this step by step. 我们将逐步进行此操作。 Let's start. 开始吧。

1. Step 1 - Create two MVC applications with default internet template and give those names as CrossSite_RequestForgery and Attack_Application respectively. 步骤1-使用默认的Internet模板创建两个MVC应用程序，并将这些名称分别命名为CrossSite_RequestForgery和Attack_Application。

2. Now, open CrossSite_RequestForgery application's Web Config and change the connection string with the one given below and then save. 现在，打开CrossSite_RequestForgery应用程序的Web Config，并使用下面给出的字符串更改连接字符串，然后保存。

` `

3. Now, click on Tools >> NuGet Package Manager, then Package Manager Console 现在，单击工具>> NuGet程序包管理器，然后单击程序包管理器控制台

4. Now, run the below mentioned three commands in Package Manager Console to create the database. 现在，在Package Manager控制台中运行下面提到的三个命令来创建数据库。

Enable-Migrations add-migration first update-database 启用迁移首先添加迁移数据库

Important Notes - I have created database with code first approach because I want to make this example in the way developers work. 重要说明-我已经使用代码优先方法创建了数据库，因为我想以开发人员的工作方式来举例说明。 You can create database manually also. 您也可以手动创建数据库。 It's your choice. 这是你的选择。

5. Now, open Account Controller. 现在，打开“帐户控制器”。 Here, you will see a register method whose type is post. 在这里，您将看到类型为post的register方法。 Above this method, there should be an attribute available as [ValidateAntiForgeryToken]. 在此方法上方，应该有一个可用的[ValidateAntiForgeryToken]属性。 Comment this attribute. 评论此属性。 Now, right click on register and click go to View. 现在，右键单击注册，然后单击转到视图。 There again, you will find an html helper as @Html.AntiForgeryToken() . 再次，您将找到一个HTML帮手，如@ Html.AntiForgeryToken（）。 Comment this one also. 也对此发表评论。 Run the application and click on register button. 运行该应用程序，然后单击注册按钮。 The URL will be open as: 该网址将以以下形式打开：

http://localhost:52269/Account/Register http：// localhost：52269 /帐户/注册

Notes - I know now the question being raised in all readers' minds is why these two helpers need to be commented, as everyone knows these are used to validate request. 注释 -我现在知道所有读者都提出了一个问题，那就是为什么需要对这两个助手进行评论，因为每个人都知道这是用来验证请求的。 Then, I just want to let you all know that this is just because I want to show the difference after and before applying these helpers. 然后，我只想让大家知道这仅仅是因为我想展示在应用这些助手之后和之前的区别。

6. Now, open the second application which is Attack_Application. 现在，打开第二个应用程序Attack_Application。 Then, open Register method of Account Controller. 然后，打开“帐户控制器”的“注册”方法。 Just change the POST method with the simple one, shown below. 只需使用简单的方法更改POST方法，如下所示。

   Registration Form 报名表格
   1. @Html.LabelFor(m => m.UserName) @Html.TextBoxFor(m => m.UserName) @ Html.LabelFor（m => m.UserName）@ Html.TextBoxFor（m => m.UserName）
   2. @Html.LabelFor(m => m.Password) @Html.PasswordFor(m => m.Password) @ Html.LabelFor（m => m.Password）@ Html.PasswordFor（m => m.Password）
   3. @Html.LabelFor(m => m.ConfirmPassword) @Html.PasswordFor(m => m.ConfirmPassword) @ Html.LabelFor（m => m.ConfirmPassword）@ Html.PasswordFor（m => m.ConfirmPassword）

7.Now, suppose you are a hacker and you know the URL from where you can register user in CrossSite_RequestForgery application. 7.现在，假设您是一名黑客，并且您知道从URL可以在CrossSite_RequestForgery应用程序中注册用户。 Now, you created a Forgery site as Attacker_Application and just put the same URL in post method. 现在，您将一个Forgery网站创建为Attacker_Application，并将相同的URL放在post方法中。

8.Run this application now and fill the register fields and click on register. 8.立即运行此应用程序并填写注册字段，然后单击注册。 You will see you are registered in CrossSite_RequestForgery application. 您将看到您已在CrossSite_RequestForgery应用程序中注册。 If you check the database of CrossSite_RequestForgery application then you will see and entry you have entered. 如果您检查CrossSite_RequestForgery应用程序的数据库，那么您将看到并输入了您输入的内容。

9. Important - Now, open CrossSite_RequestForgery application and comment out the token in Account Controller and register the View. 重要-现在，打开CrossSite_RequestForgery应用程序，在Account Controller中注释掉令牌并注册视图。 Try to register again with the same process. 尝试以相同的过程再次注册。 Then, an error will occur as below. 然后，将发生如下错误。

Server Error in '/' Application. “ /”应用程序中的服务器错误。 ________________________________________ The required anti-forgery cookie "__RequestVerificationToken" is not present. ________________________________________必需的防伪cookie“ __RequestVerificationToken”不存在。

This is what the concept says. 这就是概念所说的。 What we add in View ie @Html.AntiForgeryToken() generates __RequestVerificationToken on load time and [ValidateAntiForgeryToken] available on Controller method. 我们在View中添加的内容，即@ Html.AntiForgeryToken（）在加载时生成__RequestVerificationToken，并在Controller方法中生成[ValidateAntiForgeryToken]。 Match this token on post time. 在发布时间匹配此令牌。 If token is the same, then it means this is a valid request. 如果令牌相同，则表示这是有效请求。

---

#5楼

In ASP.Net Core anti forgery token is automatically added to forms, so you don't need to add @Html.AntiForgeryToken() if you use razor form element or if you use IHtmlHelper.BeginForm and if the form's method isn't GET. 在ASP.Net Core中，防伪令牌会自动添加到表单中，因此，如果您使用剃刀表单元素或使用IHtmlHelper.BeginForm并且表单的方法不是GET，则无需添加@Html.AntiForgeryToken() 。

It will generate input element for your form similar to this: 它将为您的表单生成类似于以下内容的输入元素：

And when user submits form this token is verified on server side if validation is enabled. 当用户提交表单时，如果启用了验证，则会在服务器端验证此令牌。

[ValidateAntiForgeryToken] attribute can be used against actions. [ValidateAntiForgeryToken]属性可用于操作。 Requests made to actions that have this filter applied are blocked unless the request includes a valid antiforgery token. 除非对该请求包含有效的防伪令牌，否则对应用了此过滤器的操作的请求将被阻止。

[AutoValidateAntiforgeryToken] attribute can be used against controllers. [AutoValidateAntiforgeryToken]属性可用于控制器。 This attribute works identically to the ValidateAntiForgeryToken attribute, except that it doesn't require tokens for requests made using the following HTTP methods: GET HEAD OPTIONS TRACE 此属性与ValidateAntiForgeryToken属性的工作方式相同，不同之处在于它不需要令牌，而使用以下HTTP方法发出的请求则不需要令牌： GET HEAD OPTIONS TRACE

Additional information: https://docs.microsoft.com/pl-pl/aspnet/core/security/anti-request-forgery 附加信息： https : //docs.microsoft.com/pl-pl/aspnet/core/security/anti-request-forgery