?????÷????????????????????? token ?????????????????Щ????????????????????????????????????????淢?????????????????????????????????????????? token????????????????????????? token?????????????? CSRF ???????????????????????????? token ?????????????ж??????????????????????????????????? token??????????????????????????????? csrftoken ????????????????????????У??????????????????? Referer ???????? token ?????? CSRF ????????????Щ????????????????? Referer ????????
?????? HTTP ????????????????
????????????????? token ?????????????????????????????????????? token ?????????????? HTTP ??????У??????????? HTTP ?????????????????? XMLHttpRequest ??????????????????и?????????? csrftoken ??? HTTP ?????????? token ????????С????????????????????????м??? token ???????????? XMLHttpRequest ????????????????????????????????????? token ????? Referer й???????????????
?????????????????????????XMLHttpRequest ??????????? Ajax ?????ж??????????????￡????????е??????????????????????????????????????????治??????????????￡????????????????????￡?????????????????????????????????н??? CSRF ??????????????????????????????????з??????????????????? XMLHttpRequest ?????????????????д????????????????????????????
????CSRF?????
????????????????????????CSRF??????????????????????????????????Ч?????????????Ч???????????????CSRF???????????????С???????????????????????????????????ο??????????Protecting ASP.NET Applications Against CSRF Attacks????
????1?????Nuget ???ARMOR Web Framework
????PM> Install-Package Daishi.Armor.WebFramework
????2??????????????
????<add key=“IsArmed” value=“true” />
????<add key=“ArmorEncryptionKey” value=“{Encryption Key}” />
????<add key=“ArmorHashKey” value=“{Hashing Key}” />
????<add key=“ArmorTimeout” value=“1200000” />
????IsArmed?? ????????ARMOR ???????
????ArmorEncryptionKey??ARMOR ?????????????????????Token
????ArmorHashKey??????????????ARMOR ???????????????????ARMOR ???????????token????????
????ArmorTimeout??????????λ??ARMOR ??token??Ч??
?????????????????δ????????
????byte[] encryptionKey = new byte[32];
????byte[] hashingKey = new byte[32];
????using (var provider = new RNGCryptoServiceProvider()) {
????provider.GetBytes(encryptionKey);
????provider.GetBytes(hashingKey);
????3????ó????м??? ???ARMOR ????
????ARMOR????? Authorization Filter?? Fortification Filter ?? ARMOR UI Components?????ASP.NET MVC??ASP.NET??Web API???????÷??????????Protecting ASP.NET Applications Against CSRF Attacks??