Take the 2-minute tour ×

Is there a way to ensure ASP.NET MVC 4 forms are protected against CSRF by default?

For instance, is there a way to have AntiForgeryToken automatically applied to all forms in both views and controller actions?

Background on this question: Prevent Cross-Site Request Forgery (CSRF) using ASP.NET MVC’s AntiForgeryToken() helper and Anatomy of a Cross-site Request Forgery Attack.

share|improve this question
I suspect that this is only really necessary on forms that grant access, such as login forms or user rights administrative forms, or forms that submit personally-identifiable information such as social security numbers and pass phrases. But I look forward to seeing the answers. –  Robert Harvey Apr 1 '12 at 14:59
Since CSRF may allow anyone to execute any action on a web application under your credentials, it seems to me that all actions that enter or modify data should be protected against it. For example, adding a record to an accounting application. –  Fernando Correia Apr 1 '12 at 15:07
They would, of course, need your credentials first. :) –  Robert Harvey Apr 1 '12 at 15:10
On the contrary. The nature of CSRF attacks is that can be done without having your credentials. Please refer to 1, 2. –  Fernando Correia Apr 1 '12 at 15:13
Ah, I see. So the attacker is capturing your authentication cookies. –  Robert Harvey Apr 1 '12 at 15:16

4 Answers 4

up vote 13 down vote accepted

To add to osoviejo's excellent answer, the instructions below, from my recent blog post on CSRF, put his work together with the information in Phil's blog in one comprehensive answer.

ASP.NET/MVC provides a mechanism for this: you can add to to a collection of filters on the global FilterProviders object. This allows you to target some controllers and not others, adding the needed security feature.

First, we need to implement an IFilterProvider. Below, you can find Phil Haack's Conditional Filter Provider class. Begin by adding this class to your project.

public class ConditionalFilterProvider : IFilterProvider
    private readonly
      IEnumerable<Func<ControllerContext, ActionDescriptor, object>> _conditions;

    public ConditionalFilterProvider(
      IEnumerable<Func<ControllerContext, ActionDescriptor, object>> conditions)
        _conditions = conditions;

    public IEnumerable<Filter> GetFilters(
        ControllerContext controllerContext,
        ActionDescriptor actionDescriptor)
        return from condition in _conditions
               select condition(controllerContext, actionDescriptor) into filter
               where filter != null
               select new Filter(filter, FilterScope.Global, null);

Then, add code to Application_Start that adds a new ConditionalFilterProvider to the global FilterProviders collection that ensures that all POST controller methods will require the AntiForgeryToken.

IEnumerable<Func<ControllerContext, ActionDescriptor, object>> conditions = 
    new Func<ControllerContext, ActionDescriptor, object>[] {
    // Ensure all POST actions are automatically 
    // decorated with the ValidateAntiForgeryTokenAttribute.

    ( c, a ) => string.Equals( c.HttpContext.Request.HttpMethod, "POST",
    StringComparison.OrdinalIgnoreCase ) ?
    new ValidateAntiForgeryTokenAttribute() : null

var provider = new ConditionalFilterProvider(conditions);

// This line adds the filter we created above

If you implement the two pieces of code above, your MVC application should require the AntiForgeryToken for every POST to the site. You can try it out on Phil Haack's CSRF example web site - once protected, the CSRF attack will throw System.Web.Mvc.HttpAntiForgeryException without having to add the [ValidateAntiForgeryToken] annotation. This rules out a whole host of "forgetful programmer" related vulnerabilities.

share|improve this answer

You can use a filter provider with a condition that the filter ValidateAntiForgeryTokenAttribute() be applied whenever HttpContext.Request.HttpMethod == "POST".

I essentially followed the generic approach described by Phil Haack, and added the appropriate condition:

// Ensure all POST actions are automatically decorated with the ValidateAntiForgeryTokenAttribute.
( c, a ) => string.Equals( c.HttpContext.Request.HttpMethod, "POST", StringComparison.OrdinalIgnoreCase ) ?
 new ValidateAntiForgeryTokenAttribute() : null
share|improve this answer
That sounds like a good approach. Thank you. –  Fernando Correia Jul 15 '12 at 21:41
I've combined this answer with the information about ConditionalFilterProvider's from Phil's blog post in a recent post about CSRF and ASP.NET/MVC. kylehodgson.com/2013/01/08/asp-netmvc-web-security-basics-csrf –  Kyle Hodgson Jan 10 '13 at 4:17

I have used FXCop to write two code analysis rules one that require that a HttpMethod attribute is applied to all controller actions and a second that requires any action that has a HttpPost attribute must also have a RequiresAntiForgeryToken attribute.

This worked well for us. The rules are not particularly hard to write

share|improve this answer

One way to do it would be to modify the T4 templates in ASP.NET MVC that create forms, to have them insert this code automatically:

    <%= Html.AntiForgeryToken() %>
    <!-- rest of form goes here -->
<% } %>

And of course, you need the corresponding attribute on the controller method:

public ViewResult SubmitUpdate()
    // ... etc

It's really not that difficult to retrofit an application in this manner, unless it's unusually large. The last application I wrote in MVC would probably take me a couple of hours to retrofit.

share|improve this answer
Robert, thank you for this sample code. It is helpful. But I'm trying to find out if there is a way to automatically have this applied over all forms and all controller actions, as a blanket. For instance, to prevent the possibility of forgetting to add the attribute to the controller method. –  Fernando Correia Apr 1 '12 at 15:52

Your Answer


