ViewStateUserKey not entirely effective against CSRF
Oh, how timely! Just a few days ago, a blog post about the limitations of ViewStateUserKey as a means to prevent CSRF in ASP.Net applications. The bottom line:
- developers can disable ViewState entirely, so it lacks central control (kind of like ripping out your firewalls and hoping everyone has an up-to-date and securely configured desktop firewall instead)
- There are some issues with the mechanism working over load-balanced connections or across IIS app pools where session IDs are likely not shared.
- Most importantly, the ViewState MAC is only checked on POSTback, so if you have apps that don’t use POSTbacks, you are still vulnerable.
The article also suggests that a CSRF Guard for .Net is needed. Well, they are in luck because it is: https://www.owasp.org/index.php/.Net_CSRF_Guard
ViewStateUserKey Doesn’t Prevent Cross-Site Request Forgery - KeepItLocked.net