The ASP.NET Core data protection API protects application data with strong symmetric encryption. It creates antiforgery tokens, encrypts authentication cookies, generates secure tokens, and manages the encryption keys required to protect and recover that data. section 29.2
Key management is part of the protection system:
- Keys are stored as small XML files containing random encryption values. section 29.2
- Storage depends on hosting: Azure Web Apps use a synced folder, IIS without user profiles uses the registry, user-profile accounts use a platform-specific data-protection directory, and other cases use memory. section 29.2
- Protect key files carefully; anyone who obtains them may decrypt protected data or impersonate users. section 29.2
Antiforgery protection
A protected form includes a hidden antiforgery token alongside its fields. The browser sends the cookie token automatically, but a malicious site cannot read and reproduce the matching form token, so the application rejects the forged request. section 29.2
Figure 29.5 Protecting against a CSRF attack using antiforgery tokens. The browser automatically forwards the cookie token, but the malicious site can’t read it and so can’t include a token in the form. The app rejects the malicious request because the tokens don’t match.
Shows how matching antiforgery tokens prevent a malicious form submission. section 29.2
