Does ValideAntiForgeryToken prevent falsifying of POST parameters?

Question

I somewhat understand how [ValidateAntiForgeryToken] prevents CSRF and I have read through this question, but I'm unsure whether this would prevent someone from falsifying the parameters for a form post.

ItemList has an Items property that is a collection of items and a User property that is a reference to the ApplicationUser that it belongs to. Item has an ItemList property that is a reference to the list it belongs to. Here are the Add methods in the ItemController:

// GET: Item/Add/4 (Adds new Item to the ItemList with ID=4)
public ActionResult Add(int? itemListId)
{
    // Gets the current user and the ItemList that the Item will be added to
    UserManager<ApplicationUser> userManager = new UserManager<ApplicationUser>(new UserStore<ApplicationUser>(db));
    ApplicationUser currentUser = userManager.FindById(User.Identity.GetUserId());
    ItemList itemList = db.ItemLists.Find(itemListId);

    // Makes sure that ItemList exists and belongs to the user
    if (itemList == null || itemList.User != currentUser)
    {
        return View("InsufficientPerm");
    }
    ViewBag.ItemListId = itemListId;
    return View();
}

// POST: Item/Add/4 (Adds new Item to the ItemList with ID=4)
[HttpPost]
[ValidateAntiForgeryToken]
public ActionResult Add([Bind(Include = "ID,Name")] Item item, int? itemListId)
{
    if (ModelState.IsValid)
    {
        ItemList itemList = db.ItemLists.Find(itemListId);

        item.ItemList = itemList;
        db.Items.Add(item);
        itemList.Items.Add(item);
        db.SaveChanges();

        return RedirectToAction("Index");
    }
    return View(item);
}

My question is whether [ValidateAntiForgeryToken] would prevent a user from falsifying the itemListId parameter during the post, or if I would need to put another if (itemList == null... check in the post method.

Edit: Here is the logic that I am looking at right now:

• The use of ValidateAntiForgeryToken forces a user to access the first method (therefore loading the view) in order for a post to be accepted. If they don't load that view, then there will be no anti-forgery token.
• The user will go to the form webpage (let's say http://foo.bar/Item/Add/3)
• The user will fill out and submit the form, which would call the post method (in this case itemListId=3 because that's the webpage that was accessed)
• There is no way for a user to pass a different itemListId to the above step, because it is passed by the webpage when they submit the form

Now, please let me know if there is something wrong with what I have stated above, or if that logic is correct (meaning that I don't need to check the validity of itemListId during the post). PLEASE give an example or a link to clarify where my logic is incorrect

Answer 1

ValidateAntiForgeryToken dont prevent falsify, it prevent that the request becomes from another place.

The ValidateAntiForgeryToken check if __RequestVerificationToken exists in the form and validate it, so whatever params is in the body of the request, if the __RequestVerificationToken is invalid will break and dont returns a 200 OK, so to use it just put the Helper @Html.AntiForgeryToken() inside the form and the [ValidateAntiForgeryToken] filter in the action.

So see this article about that: How AntiForgeryToken works

Answer 2

No. The ValidateAntiForgeryToken attribute has absolutely zero impact on the values each form field may contain. It also has absolutely no idea what data belongs to which user.

Answer 3

There is no way for a user to pass a different itemListId to the above step, because it is passed by the webpage when they submit the form

This is false. The AntiForgeryToken will not protect you from altered data.

1. Make a GET request to Item/Add/4. I assume you will have a form on this page. You can include the @Html.AntiForgeryToken().

2. Use your browser's debug tools to inspect the form.

   • Now you can edit the action attribute to directly modify Item/Add/5 the value.
   • Or modify any <input> field value.

3. Put a debug break on your POST action and you will see the altered values when you submit the form.

The above is not the only way to tamper with the data. Therefore, you should always validate any input.

[Authorize, ValidateAntiForgeryToken]
[HttpPost]
public ActionResult NukeMyBankAccount(int accountId)
{
    var account = db.GetAccount(accountId);

    // validate
    if (CurrentUser.Id != account.Owner.Id)
    {
        return RedirectToAction("Unauthorized");
    }
    else
    {
        db.NukeAccount(accountId, areYouSure: true);
    }
    ...
}

Answer 4

The CSRF attack consists in deceive victim to click in link or load a image where the URL is of a system that victim is logged, but attacker do not know the victim credentials.

The simple case, the attacker know that the HTTP GET request in the target system change some information. To attack, just send the e-mail or link to a user of the target system with a image where the URL point to the target system.

To prenvent this, a good pratice is do not create URL that make changes in data of the system through HTTP GET request.

In complex case, the attacker create a page with a form whose action point to a URL of the target system with POST method.

In this case, use the ValidateAntiForgeryToken is fundamental. Because the token generated by the target system is known only by the target system and can be validated.

So, the ValidateAntiForgeryToken only validate if the request was originated from the target system. Don't have any relationship with others parameters in the form.