Hey everyone, first post on these forums.
I would like to share my concerns on the following article:
http://www.asp.net/web-api/overview/security/preventing-cross-site-request-forgery-(csrf)-attacks. I know the article is quite old, but I believe still many users use it as a reference. Unfortunately my message became too big to put in the comments, so
I had to put it in a forum post.
I see a problem regarding the recommended implementation for Anti-CSRF for Ajax calls. The anti-CSRF protection relies highly on the expiration of the cookie. Whenever the cookie expires, the client's browser will never send that cookie to the server, hence
the time an attacker has to find the proper combination of the cookieToken and the formToken is reduced to the current time and the expiration date of the cookie. As far as me and a colleague could revers ...
Go to the complete details ...