DJR (Community Member) asked a question.
Cross-Site Request Forgery (CSRF) (CWE ID 352) - We would like to resolve this without using attribute [ValidateAntiForgeryToken].
We are using ASP.Net MVC with $.ajax and JSON content-type and want to resolve without using attribute [ValidateAntiForgeryToken].
We would like to resolve this using .Net's Antiforgery methods but not using attribute [ValidateAntiForgeryToken]. Here is a link to docs.microsoft.com in how we would like to resolve this issue.
How can we resolve it this way and still pass Veracodes scans?
Thanks
DJR
.png){kind=logo}
Hi @DJR (Community Member),
Thanks for your question. For .NET Core our advice is to continue to use the ValidateAntiForgeryToken attribute on each controller action that has an HttpPost attribute or alternatively use an AutoValidateAntiforgeryToken attribute on the controller class. Please refer to this link for guidance on how to achieve CSRF protection by using headers rather than form values to supply the token: https://docs.microsoft.com/en-us/aspnet/core/security/anti-request-forgery?view=aspnetcore-5.0. If this functionality is not available in .NET Standard, the custom header approach mentioned within the article you linked to is reasonable, provided tests are carried out to ensure the tokens are correctly validated and that any expired/invalid tokens are correctly rejected by the server. Veracode is unable to detect this implementation since the header name is customisable, and this is a non-standard implementation of CSRF. However so long as AntiForgery.Validate() is used in conjunction with @Html.AntiForgeryToken() and testing has been carried out to confirm functionality, this can be mitigated by design. You may wish to implement this in a centralised component of the application, responsible for providing this CSRF-wrapped JSON AJAX service.
Thanks,
Anthony Fielding
Veracode
Thank you for the response Anthony! If we go with the non-standard implementation approach (AntiForgery.Validate() is used in conjunction with @Html.AntiForgeryToken()), what is the proper way to mark the CSRF CWE 352 flaw as mitigated and stop having it show up as a finding? I apologize, we are in the beginning stages with Veracode.
Thanks!
DJR
Hi @DJR (Community Member),
Please find guidance on how to propose mitigations in our Help Centre here: https://help.veracode.com/r/improve_mitigation?section=mitigate__propose. Your security team would then review those mitigation proposals, and if accepted they would no longer affect the score/compliance of the application against the application policy.
Thanks,
Anthony Fielding