ViewStateUserKey 没有阻止 CSRF？
我怀疑这是由于我的测试配置造成的，但我想问问大家的想法。我正在玩一个快速测试项目。我有一个简单的表单身份验证页面和一个订单页面（两个字段和一个显示“订单”的列表）。订单页面设置为在检索参数时使用 Request.Form[]，以防止输入作为 GET 操作传入。
我在 Page_Init 中设置了 ViewStateUserKey 并明确将 EnableViewStateMac 设置为 true（即使它是默认值）。
然后我制作了一个 .HTM，它在我的订单页面上发布了一个表单，为两个字段（产品和数量）设置值。我应该注意，我没有费心制作视图状态作为表单提交的一部分。我在浏览器的真实页面上查看了源代码，删除了除表单字段之外的所有内容，添加了一些 javascript 来设置字段值并执行 form.submit()
我登录到测试项目，然后打开 .HTM。 .HTM成功提交了表单，当我刷新订单页面时，我可以看到虚假订单。
为什么 ViewStateUserKey 没有防止这种情况发生？它不是应该阻止这种类型的攻击吗？在这个例子中，我没有篡改视图状态，我只是创建了一个执行普通表单发布的页面，因此 ViewStateUserKey ONLY 在那里是为了防止 ViewState 篡改（这让我觉得完全毫无价值，或者是这是因为两个页面都位于同一台物理机器上吗？
I suspect this is due to my test configuration, but I wanted to ask you folks for your thoughts. I was playing around with a quick test project. I had a simple forms auth page and an order page (two fields and a list to show "orders"). The order page was set to use Request.Form[] when retrieving parameters to prevent input from coming in as a GET operation.
I set ViewStateUserKey in Page_Init and explicitly set EnableViewStateMac to true (even though it defaults to that).
Then I made a .HTM that did a form post to my order page that sets values for the two fields (product and quantity). I should note, I didn't bother crafting a viewstate as part of the form submit. I did View Source on the real page in my browser, cut out everything but the form fields, added some javascript to set the field values and do the form.submit()
I logged in to the test project, and opened the .HTM. The .HTM successfully submitted the form and when I refreshed the order page, I could see the bogus order.
Why didn't ViewStateUserKey protect against this? Isn't it supposed to block that very type of attack? In this example, I did not tamper with viewstate, I simply made a page that did a normal form post, so is ViewStateUserKey ONLY there to protect against ViewState tampering (which strikes me as utterly worthless, or is this working because both pages are living on the same physical machine?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您是否在测试页中包含了原始视图状态字段？如果您为特定用户复制了有效的视图状态，然后以该用户身份提交它，那么是的，您会期望它能够正常工作。
ViewStateUserKey 功能仅防止您获取由您自己的用户创建的 ViewState 并将其用于其他用户无意中提交的内容。
Did you include the original viewstate field in the test page? If you copied a valid viewstate for a particular user, and then submitted it as that user, then yes, you would expect it to just work.
The ViewStateUserKey feature only prevents you from taking a ViewState created from your own user and using it in a submission made inadvertently by another user.