Click here to Skip to main content
15,886,776 members
Please Sign up or sign in to vote.
1.00/5 (2 votes)
See more:
I want to remove the cookie from request header and set with a different name "XSRFHeader" as a separate header in asp.net with c#. With the below code the same is working in some but not in all while checking via dev tool/burp tool. Code Portion is updated below.

What I have tried:

Core Code is as below:
var responseCookie = new HttpCookie(AntiXsrfTokenKey)
                    {
                        HttpOnly = true,
                        Value = _antiXsrfTokenValue
                    };
                    if (FormsAuthentication.RequireSSL && Request.IsSecureConnection)
                    {
                        responseCookie.Secure = true;
                    }

                    //Updated by Alex on 18.1.2022 for showing AntiXSRF Token Value as a separate header XSRFHeader instead in theresponse header Start
                    //Response.Cookies.Set(responseCookie);
                    try
                    {
                        Common.WriteDDSLog("Removing Coookie AntiXSRFToken from Header Started");
                        Response.Cookies["__AntiXsrfToken"].Value = string.Empty;
                        Response.Cookies["__AntiXsrfToken"].Expires = DateTime.Now.AddMonths(-20);
                        Common.WriteDDSLog("Removing Coookie  AntiXSRFToken from Header Finished");
                    }
                    catch(Exception ex)
                    {
                        Common.WriteDDSLog("Removing Coookie AntiXSRFToken from Header Failed:" + ex.Message + Environment.NewLine + ex.InnerException + Environment.NewLine + ex.StackTrace);
                    }
                    Response.AppendHeader("XSRFHeader", _antiXsrfTokenValue);
                    Common.WriteDDSLog("Response Header Appended with cookie name XSRFHeader1:"+_antiXsrfTokenValue);
Posted
Updated 2-Feb-22 22:09pm
v2

1 solution

Your custom response header will have no effect on any web browser, and it will not be included with any subsequent requests made by the browser. It is therefore completely useless for preventing cross-site request forgery.

As I said last time you posted this question[^], you need to explain precisely why you think the anti-XSRF system extensively across the internet is somehow not suitable for your application. If you can't provide a cogent response to that, then you need to stop trying to reinvent the wheel.
 
Share this answer
 
Comments
Member 15421351 3-Feb-22 6:22am    
It's a client requirement as such. This custom header code is coming well in my hosted environment but the same not coming in another server. I just want to know the reason for that.
Richard Deeming 3-Feb-22 6:28am    
Part of your job as a developer is to tell the client when their requirements make no sense. You can't simply demand that the entire world changes to fit in with your client's requirement instead!

Agnes Skinner: "I want all my shopping in one bag. But I don't want that bag to be heavy!"
Bag packer: "Sorry ma'am, but I don't think that's possible."
Agnes Skinner: "Who are you, the 'possible' police? Just do it!"

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900