liveBook · Manning

Synchronizer token pattern

As explained in ASP.NET Core in Action, 3e

The synchronizer token pattern is a CSRF defense pattern that validates matching user-specific tokens supplied through separate request channels such as a cookie and form field.

The synchronizer token pattern defends against cross-site request forgery (CSRF) by requiring matching, user-specific antiforgery tokens through separate request channels: a cookie and a protected form field. section 29.2

A protected POST follows this sequence:

  • The application generates unique tokens for the logged-in user. section 29.2
  • One token is stored in a cookie, while another is rendered in the form. section 29.2
  • The application compares both values and rejects the request if either is missing or they do not match. section 29.2

Razor Pages form

In ASP.NET Core Razor Pages, the Form Tag Helper automatically adds an antiforgery cookie and a hidden __RequestVerificationToken field to forms unless disabled. A forged site can cause the browser to send the cookie, but cannot read it to add the matching form token. section 29.2

How ASP.NET Core in Action, 3e covers it

How deep it goes
Explains token generation, separate storage, comparison, rejection, and Razor Pages automation, without detailing token internals.
Examples
Uses a Razor form for withdrawing funds and its generated hidden __RequestVerificationToken field.
What it assumes
Assumes understanding of logged-in browser requests and cookies while explaining the CSRF failure mode from those behaviors.
What you can do after
Operate/configure Razor Pages forms with automatic antiforgery protection and recognize why forged POST requests are rejected.
How it connects
Connects CSRF with cookies, authentication, antiforgery tokens, Razor Pages, and the Form Tag Helper.
Cover of ASP.NET Core in Action, 3e
liveBookmanning.com
Read ASP.NET Core in Action, 3e on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of ASP.NET Core in Action, 3e. The section links point to the parts of the book it draws on.