Generate and validate CSRF TOKEN in .net c# having frontend in angular and not in razor

Question

Generate and validate CSRF TOKEN in .net c# having frontend in angular and not in razor

Fernando 0

how can i work with csrf tokens if i have my frontend in angular and not razor, i have this question because i have been trying to generate and validate tokens but i usually have many problems with it, i am someone who is just starting and it would be very helpful if someone could explain me how to implement them correctly, on the other hand i see that there is not much information on youtube updated talking about it, i know there is documentation and i have been guided with it but i still have problems.

AgaveJoe 30,126 Reputation points

2023-12-23T12:54:13.6133333+00:00

CSRF token are needed when the web application uses cookie authentication. It is possible the Angular application uses a cookie but it is more common that an Angular application uses OAuth. Basically, a bearer token is sent by the Angular app to access secure resources. A would-be attacker will not have the token. An XSS attach is more concerning in this type of scenario.

i have this question because i have been trying to generate and validate tokens but i usually have many problems with it,

The forum members cannot see your code. We do not know why you are unable to generate a token or how CSRF is intend to work in your application. Perhaps the docs will help.

Generate antiforgery tokens with IAntiforgery

In a standard ASP.NET Core web application, like Razor Pages, the token is passed to the browser in a hidden HTML form input. The would-be attacker does not have this token and therefore cannot create the forum input. Keep in mind, an Angular application usually does not submit an HTML form. Usually, JSON is submitted to an API and APIs do not read cookies by default.

Prevent Cross-Site Request Forgery (XSRF/CSRF) attacks in ASP.NET Core

Anyway, this is probably why you do not see a lot of information on this subject. However, Angular does have a CSRF library.

https://www.stackhawk.com/blog/angular-csrf-protection-guide-examples-and-how-to-enable-it/

If you still need CSRF support then we need more information about how your application works.

Your answer

AgaveJoe 30,126 Reputation points

2023-12-23T12:54:13.6133333+00:00

CSRF token are needed when the web application uses cookie authentication. It is possible the Angular application uses a cookie but it is more common that an Angular application uses OAuth. Basically, a bearer token is sent by the Angular app to access secure resources. A would-be attacker will not have the token. An XSS attach is more concerning in this type of scenario.

i have this question because i have been trying to generate and validate tokens but i usually have many problems with it,

The forum members cannot see your code. We do not know why you are unable to generate a token or how CSRF is intend to work in your application. Perhaps the docs will help.

Generate antiforgery tokens with IAntiforgery

In a standard ASP.NET Core web application, like Razor Pages, the token is passed to the browser in a hidden HTML form input. The would-be attacker does not have this token and therefore cannot create the forum input. Keep in mind, an Angular application usually does not submit an HTML form. Usually, JSON is submitted to an API and APIs do not read cookies by default.

Prevent Cross-Site Request Forgery (XSRF/CSRF) attacks in ASP.NET Core

Anyway, this is probably why you do not see a lot of information on this subject. However, Angular does have a CSRF library.

https://www.stackhawk.com/blog/angular-csrf-protection-guide-examples-and-how-to-enable-it/

If you still need CSRF support then we need more information about how your application works.

Share via

Generate and validate CSRF TOKEN in .net c# having frontend in angular and not in razor

Your answer