ASP MVC防伪令牌问题
这是一个理论问题。
如果有人知道我的帖子操作（URL、参数...）的所有信息，是否可以加载我的 URL 之一，解析出防伪造令牌值，并通过 ajax 调用前面提到的帖子并获得成功？
或者，这些令牌是否受到某种保护？我真的不知道，因为我才刚刚开始 MVC，我想确保我的安全。
This is a theoretical question.
Can someone, If he/she knows all about my post action (URL, parameters...), load one of my URLs, parse out the anti forgery token value, and call the previously mentioned post via ajax and get success?
Or, are this tokens somehow protected? I really don't know cause I'm just starting MVC really, and I want to be sure of my safety.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
这些令牌是为了缓解 CSRF 攻击，因此如果攻击者能够获取令牌一个特定的URL，将其放入网页中，并让你在指定的时间间隔内专门访问该网页，那么理论上他们就可以对你进行成功的CSRF攻击。其中涉及很多小概率，这将是一种相对低效的攻击，因为在简单的情况下它只有一个目标。
如果我没记错的话（目前无法检查），该令牌包含特定于一个用户的加密数据、有效提交窗口的日期时间以及可选的静态盐字符串。该令牌值被放入表单中的隐藏输入以及 cookie 中。提交表单后，每个值都会被解密，并比较各个数据的值。如果它们相同，则该请求被视为来自已知来源。
当然，在我看来，框架实现是一个非常好的实现，并且对于大多数应用程序来说都很好。
The tokens are to mitigate CSRF attacks, so if an attacker was able to get the token for a specific URL, get it into a web page and get you specifically to visit that web page within a specified time interval, then they could in theory carry out a successful CSRF attack against you. There's a lot of small probabilities involved in that and it would be a relatively inefficient attack since it has only one target in the simple case.
If I recall correctly (no way to check at present), the token contains encrypted data specific to one user, a datetime for a valid submission window and optionally a static salt string. This token value is put into a hidden input in the form and also into a cookie. When the form is submitted, the values are each decrypted and values of individual data compared. If they are the same, the request is deemed to have come from a known source.
The framework implementation is a perfectly good implementation, in my opinion of course, and will be fine for most applications.