JasonOffutt/Grassroots — Issue #19: Implement CSRF protection
Author: JasonOffutt
Created: 2011-10-13 22:31:57+00:00
State: open

Implement a per-request filter that will prevent cross site forgeries. Common solutions are to append a cryptographically secure key to the user's session upon each request. Additionally, there would be either a hidden field or an http header that would pass the key back to the server to validate the request.

Implement server-side check as a global filter to be added in Global.asax, pass key down to ViewBag then down to the view (add to main layout).