How to detect if received hidden form data match sent hiddens in ASP.NET Core MVC?

Question

In ASP.NET web forms, viewstate data is hashed and a hidden input is added to form to validate when receiving a request. So if a malicious user decides and alters the viewstate an error occurs when the form send back to application.

Is there such facility available (as an attribute or else) built in to ASP.NET Core MVC forms specially unobtrusive Ajax forms?

Thank you.

I think asp.net mvc action method, you need to declare ValidateAntiForgeryToken attribute — jalil, Mar 03 '19 at 11:00
It only works for AntiForgery attack prevention, I Changed the value of one of the hiddens using Javascript and the method executed, despite I am applied AntiForgery attribute to the method and I can see the token when inspecting rendered html using F12. — mz1378, Mar 03 '19 at 20:57

score 0 · Answer 1 · answered Mar 03 '19 at 13:42

You can use annotations, ValidateAntiForgeryToken attribute is to prevent cross-site request forgery attacks:

[HttpPost]
[ValidateAntiForgeryToken]
public ActionResult Logout()
{
    // ...
    return View();
}

Need some guide line for AntiForgeryToken use in MVC

How to detect if received hidden form data match sent hiddens in ASP.NET Core MVC?

1 Answers1