Csrf (Cross-Site Request Forgery)

Cause: I personally think that csrf is convenient in the case of Ajax, because it can be operated by your authenticated user if you do not know it, this is also known as browser hijacking. If you have passed the verification of a website, you will perform operations on the website as your role. For example, if you are an administrator, you can add other users to the Management Group, however, if someone constructs a link to add an administrator and is clicked by the Administrator, the corresponding operation will also be performed.

Solution:

Add a verification code or session token when modifying the information (ASP. NET provides an automatic defense method, that is, use the page attribute viewstateuserkey. Set the value in the page_init method: This. viewstateuserkey = session. sessionid ).