Web API和ValidateAntiForgeryToken

Question

我們有一些現有的MVC Web服務，稱爲AJAX風格的網頁。這些服務利用ValidateAntiForgeryToken屬性來幫助防止請求僞造。

我們希望將這些服務遷移到Web API，但似乎沒有等效的防僞功能。

我錯過了什麼嗎？使用Web API解決請求僞造有什麼不同的方法嗎？

Answer 1

您可以實現這樣的授權屬性：

[AttributeUsage(AttributeTargets.Method | AttributeTargets.Class, AllowMultiple = false, Inherited = true)] 
public sealed class ValidateAntiForgeryTokenAttribute : FilterAttribute, IAuthorizationFilter 
{ 
    public Task<HttpResponseMessage> ExecuteAuthorizationFilterAsync(HttpActionContext actionContext, CancellationToken cancellationToken, Func<Task<HttpResponseMessage>> continuation) 
    { 
     try 
     { 
      AntiForgery.Validate(); 
     } 
     catch 
     { 
      actionContext.Response = new HttpResponseMessage 
      { 
       StatusCode = HttpStatusCode.Forbidden, 
       RequestMessage = actionContext.ControllerContext.Request 
      }; 
      return FromResult(actionContext.Response); 
     } 
     return continuation(); 
    } 

    private Task<HttpResponseMessage> FromResult(HttpResponseMessage result) 
    { 
     var source = new TaskCompletionSource<HttpResponseMessage>(); 
     source.SetResult(result); 
     return source.Task; 
    } 
} 

，然後用它裝點您的API操作：

[ValidateAntiForgeryToken] 
public HttpResponseMessage Post() 
{ 
    // some work 
    return Request.CreateResponse(HttpStatusCode.Accepted); 
} 

Answer 2

這link的幫助下，你可以從剃刀視圖中的防僞標記並將令牌作爲標題傳遞給：

var csrfToken = $("input[name='__RequestVerificationToken']").val(); 
$.ajax({ 
    headers: { __RequestVerificationToken: csrfToken }, 
    type: "POST", 
    dataType: "json", 
    contentType: 'application/json; charset=utf-8', 
    url: "/api/products", 
    data: JSON.stringify({ name: "Milk", price: 2.33 }), 
    statusCode: { 
     200: function() { 
      alert("Success!"); 
     } 
    } 
}); 

Answer 3

補充以上代碼 FilterAttribute

[AttributeUsage(AttributeTargets.Method | AttributeTargets.Class, AllowMultiple = false, Inherited = true)] 
    public sealed class ValidateAntiForgeryTokenAttribute : FilterAttribute, IAuthorizationFilter 
    { 
     public Task<HttpResponseMessage> ExecuteAuthorizationFilterAsync(HttpActionContext actionContext, CancellationToken cancellationToken, Func<Task<HttpResponseMessage>> continuation) 
     { 
      try 
      { 
       string cookieToken = ""; 
       string formToken = ""; 

       IEnumerable<string> tokenHeaders; 
       if (actionContext.Request.Headers.TryGetValues("RequestVerificationToken", out tokenHeaders)) 
       { 
        string[] tokens = tokenHeaders.First().Split(':'); 
        if (tokens.Length == 2) 
        { 
         cookieToken = tokens[0].Trim(); 
         formToken = tokens[1].Trim(); 
        } 
       } 
       AntiForgery.Validate(cookieToken, formToken); 
      } 
      catch (System.Web.Mvc.HttpAntiForgeryException e) 
      { 
       actionContext.Response = new HttpResponseMessage 
       { 
        StatusCode = HttpStatusCode.Forbidden, 
        RequestMessage = actionContext.ControllerContext.Request 
       }; 
       return FromResult(actionContext.Response); 
      } 
      return continuation(); 
     } 

     private Task<HttpResponseMessage> FromResult(HttpResponseMessage result) 
     { 
      var source = new TaskCompletionSource<HttpResponseMessage>(); 
      source.SetResult(result); 
      return source.Task; 
     } 

的HTML功能使用剃刀

@functions{ 
    public string TokenHeaderValue() 
     { 
      string cookieToken, formToken; 
      AntiForgery.GetTokens(null, out cookieToken, out formToken); 
      return cookieToken + ":" + formToken; 
     } 
} 

採用了棱角分明

return $http({ 
    method: 'POST', 
    url: '@Url.Content("~/api/invite/")', 
    data: {}, 
    headers: { 
     'RequestVerificationToken': '@TokenHeaderValue()' 
    } 
}); 

Answer 4

奧斯瓦爾多的答案，但作爲一個AuthorizeAttribute

[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, AllowMultiple = false, Inherited = true)] 
    public class ApiValidateAntiForgeryToken : AuthorizeAttribute 
    { 
    public static string GenerateAntiForgeryTokenForHeader() { 
     string cookieToken, formToken; 
     AntiForgery.GetTokens(null, out cookieToken, out formToken); 
     return cookieToken + ":" + formToken; 
    } 


    protected override bool IsAuthorized(HttpActionContext actionContext) { 
     var headers = actionContext.Request.Headers; 

     // we pass both the cookie and the form token into a single header field 
     string headerToken = headers.Contains("__RequestVerificationToken") ? headers.GetValues("__RequestVerificationToken").FirstOrDefault() : null; 

     if (headerToken == null) { 
     return false; 
     } 

     string[] tokens = headerToken.Split(':'); 
     if (tokens.Length != 2) { 
     return false; 
     } 

     string cookieToken = tokens[0].Trim(); 
     string formToken = tokens[1].Trim(); 

     try { 
     AntiForgery.Validate(cookieToken, formToken); 
     } 
     catch { 
     return false; 
     } 

     return base.IsAuthorized(actionContext); 
    } 
    } 

實施您可以用[ApiValidateAntiForgeryToken]修飾您的控制器或方法，然後在您的剃鬚刀JavaScript代碼中將該方法的標頭傳遞給RequestVerificationToken：「@ ApiValidateAntiForgeryToken.GenerateAntiForgeryTokenForHeader（）」。

Answer 5

考慮到這一點之後，混合cookie和表單標記是一個壞主意，因爲它違背了反僞造標記的整個目的。最好將cookie部分保存爲cookie，同時將表單部分移動到auth頭部，因此這個新的答案（又作爲AuthorizeAttribute）。

using System; 
using System.Linq; 
using System.Net.Http; 
using System.Web; 
using System.Web.Helpers; 
using System.Web.Http; 
using System.Web.Http.Controllers; 

    [AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, AllowMultiple = false, Inherited = true)] 
    public class ApiValidateAntiForgeryToken : AuthorizeAttribute { 
    public const string HeaderName = "X-RequestVerificationToken"; 

    private static string CookieName => AntiForgeryConfig.CookieName; 

    public static string GenerateAntiForgeryTokenForHeader(HttpContext httpContext) { 
     if (httpContext == null) { 
     throw new ArgumentNullException(nameof(httpContext)); 
     } 

     // check that if the cookie is set to require ssl then we must be using it 
     if (AntiForgeryConfig.RequireSsl && !httpContext.Request.IsSecureConnection) { 
     throw new InvalidOperationException("Cannot generate an Anti Forgery Token for a non secure context"); 
     } 

     // try to find the old cookie token 
     string oldCookieToken = null; 
     try { 
     var token = httpContext.Request.Cookies[CookieName]; 
     if (!string.IsNullOrEmpty(token?.Value)) { 
      oldCookieToken = token.Value; 
     } 
     } 
     catch { 
     // do nothing 
     } 

     string cookieToken, formToken; 
     AntiForgery.GetTokens(oldCookieToken, out cookieToken, out formToken); 

     // set the cookie on the response if we got a new one 
     if (cookieToken != null) { 
     var cookie = new HttpCookie(CookieName, cookieToken) { 
      HttpOnly = true, 
     }; 
     // note: don't set it directly since the default value is automatically populated from the <httpCookies> config element 
     if (AntiForgeryConfig.RequireSsl) { 
      cookie.Secure = AntiForgeryConfig.RequireSsl; 
     } 
     httpContext.Response.Cookies.Set(cookie); 
     } 

     return formToken; 
    } 


    protected override bool IsAuthorized(HttpActionContext actionContext) { 
     if (HttpContext.Current == null) { 
     // we need a context to be able to use AntiForgery 
     return false; 
     } 

     var headers = actionContext.Request.Headers; 
     var cookies = headers.GetCookies(); 

     // check that if the cookie is set to require ssl then we must honor it 
     if (AntiForgeryConfig.RequireSsl && !HttpContext.Current.Request.IsSecureConnection) { 
     return false; 
     } 

     try { 
     string cookieToken = cookies.Select(c => c[CookieName]).FirstOrDefault()?.Value?.Trim(); // this throws if the cookie does not exist 
     string formToken = headers.GetValues(HeaderName).FirstOrDefault()?.Trim(); 

     if (string.IsNullOrEmpty(cookieToken) || string.IsNullOrEmpty(formToken)) { 
      return false; 
     } 

     AntiForgery.Validate(cookieToken, formToken); 
     return base.IsAuthorized(actionContext); 
     } 
     catch { 
     return false; 
     } 
    } 
    } 

然後只是裝飾你的控制器或[ApiValidateAntiForgeryToken]

並加入到剃刀文件這個來生成令牌JavaScript方法：

<script> 
var antiForgeryToken = '@ApiValidateAntiForgeryToken.GenerateAntiForgeryTokenForHeader(HttpContext.Current)'; 
// your code here that uses such token, basically setting it as a 'X-RequestVerificationToken' header for any AJAX calls 
</script>