> For the complete documentation index, see [llms.txt](https://bharat-tiwari.gitbook.io/our-tech-journal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://bharat-tiwari.gitbook.io/our-tech-journal/web/csrf.md).

# CSRF

CSRF = Cross-site Request Forgery

A hacker site sends requests to your server posing itself as a valid authenticated user from another tab in the same browser session where user is logged in.

To prevent CSRF, backend data services usually implement a **CORS** policy , which means it would only allow access to data if the request contains a valid token in the header

## In ASP.Net MVC

To avoid CSRF, ASP.net MVC uses `AntiForgeryToken` that can be added to a form which user submits to send request. This would create a unique session token and passed as a hidden field's value in the form.

```markup
    ...
    <div>
        <form action="Transfer" method="post">
        Amount: <input type="text" name="Amount" value="" /><br />
        To Account: <input type="text" name="Account" value="" /><br />
    <input type="submit" value="Transfer Money" />
    @Html.AntiForgeryToken("someSecretKey1")
    </div>
    ...
```

The MVC controller action that processes the request can be decorated with `[ValidateAntiForgeryToken(salt="someSecretKey1")]` decorator:

```csharp
    class MoneyTransactionController: Controller 
    {
        [ValidateAntiForgeryToken(
        public ActionResult Transfer()
        {
            //business logic to handle money transfer
            return View();
        }

    }
```

## In AngularJS

On any ajax($http) request, the `$http` service reads a cookie (which is named `XSRF-TOKEN` by default) and adds it to the HTTP request headers named as `X-XSRF-TOKEN`. Because only the JavaScript that runs on your domain could read the cookie and set the header, the server would be sure that the request came from the valid domain. The header will not be set for cross-domain requests. For this to work, on the server side, it should set a unique user specific session cookie token called `XSRF-TOKEN` on the first HTTP GET request. And then on the subsequent server requests, the server can verify that the cookie matches `X-XSRF-TOKEN HTTP` header.

The name of the headers can be specified using the `xsrfHeaderName` and `xsrfCookieName` properties of either `$httpProvider.defaults` at config-time, `$http.defaults` at run-time, or the per-request config object.