Asp.net MVC 3 防止 CrossSite Request Forgery (CSRF)原理及扩展

        Cross-Site Request Forgery (CSRF) 是我们Web站点中常见的安全隐患。 下面我们在Asp.net MVC3 来演示一下。 例如我们有一个HomeContoller中一个Submit Action，我们标记了Http Post

[HttpPost]
public ActionResult Submit(FormCollection fc)
{
    if (!string.IsNullOrEmpty(fc["Title"]))
    {
        ViewBag.Message = "Submit success!";
        return View("Index");
    }
    return View("Error");
}

在View 使用Razor 简单提交是这样：

@using (Html.BeginForm("Submit", "Home"))
  {
      @Html.TextBox("Title","text");
      <input type="submit" value="Submit" id="sb1" />
  }

点击这个Button我们就提交表单了，接下来我们轻易使用Fiddler来伪造这个Http Post请求:

然后提交，成功了，返回 OK.

POST http://localhost:55181/Home/Submit  HTTP/1.1
User-Agent: Fiddler
Host: localhost:55181
Content-Length: 10

Title=text

那在Asp.net MVC 3 Web Application中如何防止呢？在View中使用

@Html.AntiForgeryToken()

这时当Web应用程序运行时，查看生成HTML，你会看到form标签后有一个hidden input标签

<form action="/Home/Submit2" method="post">
<input name="__RequestVerificationToken" type="hidden"
 value="WiB+H5TNp6V27ALYB3z/1nkD9BLaZIBbWQOBEllj2R/+MkGZqOjLbIof2MJeEoyUJV2ljujNR4etYV6idzji
G4+JL77P9qmeewc4Erh8LnMBHX6zLas2L67GDhvCom0dpiDZl0cH+PykIC/R+HYzEIUTK/thXuF8OUtLwIfKdly0650U
3I7MD6/cIc5aersJBMZ/p6gv76gc6nvKJDt2w0eMy3tkEfAcnNPTdeWr59Ns+48gsGpZ2GSh6G+Uh7rb" />
<input id="Title" name="Title" type="text" value="text" />
<br /> <input type="submit" value="Submit" id="sb1" />

看源代码是GetHtml方法序列化相应值生成的，

public HtmlString GetHtml(HttpContextBase httpContext, string salt, string domain, string path)
{
    Debug.Assert(httpContext != null);

    string formValue = GetAntiForgeryTokenAndSetCookie(httpContext, salt, domain, path);
    string fieldName = AntiForgeryData.GetAntiForgeryTokenName(null);

    TagBuilder builder = new TagBuilder("input");
    builder.Attributes["type"] = "hidden";
    builder.Attributes["name"] = fieldName;
    builder.Attributes["value"] = formValue;
    return new HtmlString(builder.ToString(TagRenderMode.SelfClosing));
}

同时还写Cookies

__RequestVerificationToken_Lw__=T37bfAdCkz0o1iXbAvH4v0bdpGQxfZP2PI5aTJgLL/Yhr3128FUY+fvUPApBqz7CGd2uxPiW+lsZ5tvRbeLSetARbHGxPRqiw4LZiPpWrpU9XY8NO4aZzNAdMe+l3q5EMw2iIFB/6UfriWxD7X7n/8P43LJ4tkGgv6BbrGWmKFo=

更多细节，请查询源代码。然后在Action上增加 [ValidateAntiForgeryToken] 就可以了，它是这样工作的:



public void Validate(HttpContextBase context, string salt) {
    Debug.Assert(context != null);

    string fieldName = AntiForgeryData.GetAntiForgeryTokenName(null);
    string cookieName = AntiForgeryData.GetAntiForgeryTokenName(context.Request.ApplicationPath);

    HttpCookie cookie = context.Request.Cookies[cookieName];
    if (cookie == null || String.IsNullOrEmpty(cookie.Value)) {
        // error: cookie token is missing
        throw CreateValidationException();
    }
    AntiForgeryData cookieToken = Serializer.Deserialize(cookie.Value);

    string formValue = context.Request.Form[fieldName];
    if (String.IsNullOrEmpty(formValue)) {
        // error: form token is missing
        throw CreateValidationException();
    }
    AntiForgeryData formToken = Serializer.Deserialize(formValue);

    if (!String.Equals(cookieToken.Value, formToken.Value, StringComparison.Ordinal)) {
        // error: form token does not match cookie token
        throw CreateValidationException();
    }

    string currentUsername = AntiForgeryData.GetUsername(context.User);
    if (!String.Equals(formToken.Username, currentUsername, StringComparison.OrdinalIgnoreCase)) {
        // error: form token is not valid for this user
        // (don't care about cookie token)
        throw CreateValidationException();
    }

    if (!String.Equals(salt ?? String.Empty, formToken.Salt, StringComparison.Ordinal)) {
        // error: custom validation failed
        throw CreateValidationException();
    }
}

从Cookie中获得之前序列化存入的Token，然后反序列化与表单提交的Token进行对比。 接着，又对当前请求的用户认证进行确认。 最后看有没有设置Salt，有的话再进行比较。其中有一步验证没有通过，则throw异常。
有时的需求是这样的，我们需要使用Session验证用户，那么我们可在上面方法修改增加下面的代码块,意图是对比之前Session值是否与当前认证后Session值相等：

//verify session
if (!String.Equals(formToken.SessionId, AntiForgeryData.GetGUIDString(), StringComparison.Ordinal))
{
    throw CreateValidationException();
}

在修改AntiForgeryDataSerializer类，它负责序列化，这里我们增加了SessionId属性: 

internal class AntiForgeryDataSerializer
  {
      [SuppressMessage("Microsoft.Usage", "CA2202:Do not dispose objects multiple times", Justification = "MemoryStream is resilient to double-Dispose")]
      public virtual AntiForgeryData Deserialize(string serializedToken)
      {
          if (String.IsNullOrEmpty(serializedToken))
          {
              throw new ArgumentException("Argument_Cannot_Be_Null_Or_Empty", "serializedToken");
          }

          try
          {
              using (MemoryStream stream = new MemoryStream(Decoder(serializedToken)))
              using (BinaryReader reader = new BinaryReader(stream))
              {
                  return new AntiForgeryData
                  {
                      Salt = reader.ReadString(),
                      Value = reader.ReadString(),
                      CreationDate = new DateTime(reader.ReadInt64()),
                      Username = reader.ReadString(),
                      SessionId=reader.ReadString()
                  };
              }
          }
          catch (Exception ex)
          {
              throw new System.Web.Mvc.HttpAntiForgeryException("AntiForgeryToken_ValidationFailed", ex);
          }
      }

      [SuppressMessage("Microsoft.Usage", "CA2202:Do not dispose objects multiple times", Justification = "MemoryStream is resilient to double-Dispose")]
      public virtual string Serialize(AntiForgeryData token)
      {
          if (token == null)
          {
              throw new ArgumentNullException("token");
          }

          using (MemoryStream stream = new MemoryStream())
          using (BinaryWriter writer = new BinaryWriter(stream))
          {
              writer.Write(token.Salt);
              writer.Write(token.Value);
              writer.Write(token.CreationDate.Ticks);
              writer.Write(token.Username);
              writer.Write(token.SessionId);

              return Encoder(stream.ToArray());
          }
      }
}

在View这样使用,并引入Salt，这使得我们安全机制又提升了一点儿。 

@using (Html.BeginForm("Submit2", "Home"))
  {
      @Html.AntiForgeryToken(DebugMvc.Controllers.Config.SALT);
      @Html.TextBox("Title","text");
      <br />
      <input type="submit" value="Submit" id="sb1" />

  }

Action的特性上，我们也配置对应的Salt字符串:

[HttpPost]
[ValidateAntiForgeryToken(Salt = Config.SALT)]
public ActionResult Submit2(FormCollection fc)
{
    if (!string.IsNullOrEmpty(fc["Title"]))
    {
        ViewBag.Message = "Submit success!";
        return View("Index");
    }
    return View("Error");
}

配置类:
public class Config
{
    public const string SALT = "Why you are here";
}

这个实现一个简单的Session在HttpModule中,

public class MySessionModule:IHttpModule
{
    #region IHttpModule Members

    public void Dispose(){}

    public void Init(HttpApplication context)
    {
        context.AcquireRequestState += new EventHandler(this.AcquireRequestState);
    }

    #endregion

    protected void AcquireRequestState(object sender, EventArgs e)
    {
        HttpApplication httpApp = (HttpApplication)sender;
        if (httpApp.Context.CurrentHandler is IRequiresSessionState)
        {
            if (httpApp.Session.IsNewSession)
            {
                httpApp.Session["GUID"] = Guid.NewGuid();
            }

        }
    }
}

这时我们再使用Fiddler模拟请求POST到这个Action,后得到下面的结果，这个异常信息也是可以修改的:

AntiForgeryToken_ValidationFailed

Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.
Exception Details: System.Web.Mvc.HttpAntiForgeryException: AntiForgeryToken_ValidationFailed

最后让我们来看单元测试的代码:

namespace DebugMvc.Ut
{
    using System;
    using System.Collections.Generic;
    using System.Linq;
    using System.Web;
    using Microsoft.VisualStudio.TestTools.UnitTesting;
    using DebugMvc.Controllers;
    using System.Web.Mvc;
    using Moq;
    using System.Collections.Specialized;
    using Match = System.Text.RegularExpressions.Match;
    using System.Text.RegularExpressions;
    using System.Globalization;

    [TestClass]
    public class UnitTestForAll
    {
        private static string _antiForgeryTokenCookieName = AntiForgeryData.GetAntiForgeryTokenName("/SomeAppPath");
        private const string _serializedValuePrefix = @"<input name=""__RequestVerificationToken"" type=""hidden"" value=""Creation: ";
        private const string _someValueSuffix = @", Value: some value, Salt: some other salt, Username: username"" />";
        private readonly Regex _randomFormValueSuffixRegex = new Regex(@", Value: (?<value>[A-Za-z0-9/\+=]{24}), Salt: some other salt, Username: username"" />$");
        private readonly Regex _randomCookieValueSuffixRegex = new Regex(@", Value: (?<value>[A-Za-z0-9/\+=]{24}), Salt: ");

        [TestMethod]
        public void TestValidateAntiForgeryToken2Attribute()
        {
            //arrange
            var mockHttpContext = new Mock<HttpContextBase>();

            var context = mockHttpContext.Object;
            var authorizationContextMock = new Mock<AuthorizationContext>();
            authorizationContextMock.SetupGet(ac => ac.HttpContext).Returns(context);

            bool validateCalled = false;
            Action<HttpContextBase, string> validateMethod = (c, s) =>
            {
                Assert.AreSame(context, c);
                Assert.AreEqual("some salt", s);
                validateCalled = true;
            };
            var attribute = new ValidateAntiForgeryToken2Attribute(validateMethod)
            {
                Salt = "some salt"
            };

            // Act
            attribute.OnAuthorization(authorizationContextMock.Object);

            // Assert
            Assert.IsTrue(validateCalled);
        }

        [TestMethod]
        public void GetHtml_ReturnsFormFieldAndSetsCookieValueIfDoesNotExist()
        {
            // Arrange
            AntiForgeryWorker worker = new AntiForgeryWorker()
            {
                Serializer = new DummyAntiForgeryTokenSerializer()
            };
            var context = CreateContext();

            // Act
            string formValue = worker.GetHtml(context, "some other salt", null, null).ToHtmlString();

            // Assert
            Assert.IsTrue(formValue.StartsWith(_serializedValuePrefix), "Form value prefix did not match.");

            Match formMatch = _randomFormValueSuffixRegex.Match(formValue);
            string formTokenValue = formMatch.Groups["value"].Value;

            HttpCookie cookie = context.Response.Cookies[_antiForgeryTokenCookieName];
            Assert.IsNotNull(cookie, "Cookie was not set correctly.");
            Assert.IsTrue(cookie.HttpOnly, "Cookie should have HTTP-only flag set.");
            Assert.IsTrue(String.IsNullOrEmpty(cookie.Domain), "Domain should not have been set.");
            Assert.AreEqual("/", cookie.Path, "Path should have remained at '/' by default.");

            Match cookieMatch = _randomCookieValueSuffixRegex.Match(cookie.Value);
            string cookieTokenValue = cookieMatch.Groups["value"].Value;

            Assert.AreEqual(formTokenValue, cookieTokenValue, "Form and cookie token values did not match.");
        }

        private static HttpContextBase CreateContext(string cookieValue = null, string formValue = null, string username = "username")
        {
            HttpCookieCollection requestCookies = new HttpCookieCollection();
            if (!String.IsNullOrEmpty(cookieValue))
            {
                requestCookies.Set(new HttpCookie(_antiForgeryTokenCookieName, cookieValue));
            }
            NameValueCollection formCollection = new NameValueCollection();
            if (!String.IsNullOrEmpty(formValue))
            {
                formCollection.Set(AntiForgeryData.GetAntiForgeryTokenName(null), formValue);
            }

            Mock<HttpContextBase> mockContext = new Mock<HttpContextBase>();
            mockContext.Setup(c => c.Request.ApplicationPath).Returns("/SomeAppPath");
            mockContext.Setup(c => c.Request.Cookies).Returns(requestCookies);
            mockContext.Setup(c => c.Request.Form).Returns(formCollection);
            mockContext.Setup(c => c.Response.Cookies).Returns(new HttpCookieCollection());
            mockContext.Setup(c => c.User.Identity.IsAuthenticated).Returns(true);
            mockContext.Setup(c => c.User.Identity.Name).Returns(username);

            var sessionmock = new Mock<HttpSessionStateBase>();
            sessionmock.Setup(s => s["GUID"]).Returns(Guid.NewGuid().ToString());

            mockContext.Setup(c => c.Session).Returns(sessionmock.Object);

            return mockContext.Object;
        }
    }

    internal class DummyAntiForgeryTokenSerializer : AntiForgeryDataSerializer
    {
        public override string Serialize(AntiForgeryData token)
        {
            return String.Format(CultureInfo.InvariantCulture, "Creation: {0}, Value: {1}, Salt: {2}, Username: {3}",
                    token.CreationDate, token.Value, token.Salt, token.Username);
        }
        public override AntiForgeryData Deserialize(string serializedToken)
        {
            if (serializedToken == "invalid")
            {
                throw new HttpAntiForgeryException();
            }
            string[] parts = serializedToken.Split(':');
            return new AntiForgeryData()
            {
                CreationDate = DateTime.Parse(parts[0], CultureInfo.InvariantCulture),
                Value = parts[1],
                Salt = parts[2],
                Username = parts[3]
            };
        }
    }
}

这里只是UnitTest的一部分，使用Moq来实现Mock HttpContext，从而实现对HttpContext的单元测试。 

小结： Web站点的安全问题，不可轻视。特别现在Ajax大量应用，做好安全检测很重要。

希望对您Web开发有帮助。

作者：Petter Liu
出处：http://www.cnblogs.com/wintersun/
本文版权归作者和博客园共有，欢迎转载，但未经作者同意必须保留此段声明，且在文章页面明显位置给出原文连接，否则保留追究法律责任的权利。
该文章也同时发布在我的独立博客中-Petter Liu Blog。