Preventing Cross-Site Request Forgery (CSRF) Attacks in ASP.NET Web API
Cross-Site Request Forgery (CSRF) is an attack where a malicious site sends a request to a vulnerable site where the user is currently logged in Here is an example of a CSRF attack: A user logs into www.example.com, using forms authentication. The server authenticates the user. The response from the server includes an authentication cookie. Without logging out, the user visits a malicious web site. This malicious site contains the following HTML form: <h1> You Are a Winner! </h1> <form action = "http://example.com/api/account" method = "post" > <input type = "hidden" name = "Transaction" value = "withdraw" /> <input type = "hidden" name = "Amount" value = "1000000" /> <input type = "submit" value = "Click Me" /> </form> Notice that the form action posts to the vulnerable site, not to the malicious site...