2

I want to modify the AntiForgeryToken for each request.

I read these posts:

The initial post clearly rules it out, but the latter seems to mention that it is "quite simple". However I did not quite get how to achieve single use for the token.

Under my current implementation I have tokens delivered as Secure http-only cookies. But it stays constant for the entire session. I don't care if my implementation breaks the back button. Any suggestions?

Community
  • 1
  • 1
CodeReaper
  • 775
  • 2
  • 6
  • 21

1 Answers1

0

Since we don't have your example not sure how you are using this, but a simple form like this does display a new token on every request in the form

@using (Html.BeginForm()) {
@Html.AntiForgeryToken()
@Html.ValidationSummary(true)<fieldset>
    <legend>Person</legend>

    <div class="editor-label">
        @Html.LabelFor(model => model.Name)
    </div>
    <div class="editor-field">
        @Html.EditorFor(model => model.Name)
        @Html.ValidationMessageFor(model => model.Name)
    </div>

    <div class="editor-label">
        @Html.LabelFor(model => model.Address)
    </div>
    <div class="editor-field">
        @Html.EditorFor(model => model.Address)
        @Html.ValidationMessageFor(model => model.Address)
    </div>

    <p>
        <input type="submit" value="Save" />
    </p>
</fieldset> }

Form above shows me different values in each request like

<input name="__RequestVerificationToken" type="hidden" value="53WW641jzT5QWcIrrLltqF0OGt79US1eBwue1MQU6lW200CxUiD6fcC949RZee4gcNrFNnaP5QYFi6lJd_QmuUqSfex7wWHwWjUC30_kVrI1" />

<input name="__RequestVerificationToken" type="hidden" value="QXHlA8N9g_95YbPeEpjPHhjQFV9IMNJf7eEdnPnADH9BPgQg_DQQKQqf9diPAxMQWJoBcT6FeXCIECe-Qd6Q6wA5BimVlU9K0C67nokzuXQ1" />

There is more information on SO here which also references to other detailed information outside here

Community
  • 1
  • 1
Subhash Dike
  • 1,836
  • 1
  • 22
  • 37
  • Thanks, but its not what I asked specifically. I understand that a new token is generated where '@Html.AntiForgeryToken()' is called. However what I want to know is, on the server side, how do I reject a request which contains a verification token that has been previously used. – CodeReaper Aug 24 '16 at 10:14
  • with the current implementation, there is nothing preventing the client from submitting the same form multiple times with the same antiforgery token. Its reusable. Even though a new one is generated for each page load. (or even if `@Html.AntiForgeryToken()` is called multiple times on the same page) – CodeReaper Aug 24 '16 at 10:16