什么时候不需要/不需要使用 AntiForgeryToken？
UPD：在 security.stackexchange.com 和我得到的答案是不同的。请关注这里，以获得正确答案！
我正在运行一个相当大的网站，每天有数千次访问，并且有一个相当大的用户群。
自从我开始迁移到 MVC 3 以来，我一直将 AntiForgeryToken 放入多种表单中，以修改受保护的数据等。
其他一些表单（例如登录/注册）现在也使用 AntiForgeryToken，但我开始怀疑它们的用途首先需要那里，出于几个原因......
- 登录表单要求发布者知道正确的凭据。我真的想不出 csrf 攻击会在这里受益。特别是如果我检查请求是否来自同一主机（检查 Referrer 标头）
- AntiForgeryToken 令牌每次加载页面时都会生成不同的值。如果我在登录页面上打开两个选项卡，然后尝试发布它们，第一个将成功加载。第二个将失败并出现 AntiForgeryTokenException（首先加载两个页面，然后尝试发布它们）。对于更安全的页面 - 这显然是一种必要的罪恶，对于登录页面 - 似乎有点矫枉过正，只是自找麻烦：S
可能还有其他原因导致人们在表单中使用/不使用令牌..我是否正确假设在每个帖子表单中使用令牌是不好的/过度杀伤力，如果是这样 - 什么样的表单会从中受益，哪些表单肯定不会受益？
UPD: Same question asked on security.stackexchange.com and the answer I got is different. Please follow there, to get the correct answer!
I'm running a rather large site with thousands of visits every day, and a rather large userbase.
Since I started migrating to MVC 3, I've been putting the AntiForgeryToken in a number of forms, that modify protected data etc.
Some other forms, like the login / registration also use the AntiForgeryToken now, but I'm becoming dubious about their need there in the first place, for a couple reasons...
- The login form requires the poster to know the correct credentials. I can't really think of any way an csrf attack would benefit here. Especially if I check that the request came from the same host (checking the Referrer header)
- The AntiForgeryToken token generates different values every time the page is loaded.. If I have two tabs open with the login page, and then try to post them, the first one will successfully load. The second will fail with a AntiForgeryTokenException (first load both pages, then try to post them). With more secure pages - this is obviously a necessary evil, with the login pages - seems like overkill, and just asking for trouble :S
There are possibly other reasons why would one use/not use the token in their forms.. Am I correct in assuming that using the token in every post form is bad / overkill, and if so - what kind of forms would benefit from it, and which ones would definitely NOT benefit?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
防伪令牌在用户尚未经过身份验证的网站公共部分（例如登录和注册表单）毫无用处。 CSRF 攻击的工作方式如下：
因此，您可以在站点的经过身份验证的部分上使用防伪令牌，其中包含可以以某种方式修改用户状态的操作。
备注：检查 Referer 标头来识别请求来自您的网站是不安全的。任何人都可以伪造请求并欺骗此标头。
Anti forgery tokens are useless in public parts of the site where users are not yet authenticated such as login and register forms. The way CSRF attack works is the following:
So you could use anti forgery tokens on authenticated parts of your site containing actions that could modify somehow the user state.
Remark: checking the Referer header for identifying that a request came from your site is not secure. Anyone can forge a request and spoof this header.