Prevent Cross-Site Request Forgery Attacks (CSRF)

• Nov 11, 2025
• 4 minutes to read

In Cross-Site Request Forgery (CSRF) attacks, a threat actor tricks an authenticated user into executing unauthorized commands.

Use anti-forgery tokens to protect your application from CSRF attacks. These tokens work as follows:

1. Once the client requests an HTML page with a form, the server generates two random tokens.
2. The server adds these tokens in the response. It sends one token as an HttpOnly cookie and places another token in a hidden form field.
3. Each time a user submits the form, the client sends tokens back to the server.
4. If the server receives a request that does not include both tokens or if one of tokens was modified, the server rejects the request.

Note

Do not use the GET method to send data modifying requests.

Use Anti-Forgery Tokens

To add anti-forgery tokens to a Razor page:

1. In the view code, generate an AntiForgery token for a form:

   Razor

   @using(Html.BeginForm()) {
       @Html.AntiForgeryToken()
       // ...
   }
   

2. Make certain that AJAX requests for all controls include the token value:

   Razor

   <script>
   
   if (window.jQuery) {
       $.ajaxPrefilter(function (options, originalOptions, xhr) {
           if (options.dataType && options.dataType !== "html")
               return;
   
           var tokenValue = $('input:hidden[name="__RequestVerificationToken"]').val();
           if (tokenValue && options && options.data && options.data.indexOf('RequestVerificationToken') === -1)
               options.data += "&__RequestVerificationToken=" + tokenValue;
       });
   }
   </script>
   

3. To validate the request token on the server, apply the ValidateAntiForgeryToken attribute to the corresponding controller action:

   C#

   [ValidateAntiForgeryToken]
   public ActionResult EditFormDeletePartial(int id = -1) {
       if(id >= 0)
           EditFormItems.Delete(id);
       return EditFormPartial();
   }
   

Use Anti‑Forgery Tokens with Individual Controls

Note

The following steps supplement, but do not replace, the anti‑forgery token validation for page-level callbacks described above. Implement both mechanisms for complete CSRF protection.

Dashboard Designer

To protect against CSRF attacks when using the Dashboard Designer:

1. Inject an anti-forgery token into the Dashboard’s AJAX request header as follows:

   Razor

   <script type="text/javascript">
       function onBeforeRender(s, e) {
           var dashboardControl = s.GetDashboardControl();
           dashboardControl.remoteService.headers['__RequestVerificationToken'] = document.querySelector('input[name=__RequestVerificationToken]').value;
       }
   </script>
   
   @using(Html.BeginForm()) {
       @Html.AntiForgeryToken()
   
       @Html.DevExpress().Dashboard(settings => {
           settings.Name = "Dashboard";
           settings.ControllerName = "DashboardWithAntiForgeryToken";
           settings.InitialDashboardId = "editId";
           settings.ClientSideEvents.BeforeRender = "onBeforeRender";
           settings.ClientSideEvents.Init = "onBeforeRender";
       }).GetHtml()
   }
   

2. Define a custom attribute to validate the anti-forgery token on requests:

   C#

   public sealed class DashboardValidateAntiForgeryTokenAttribute : FilterAttribute, IAuthorizationFilter {
       public void OnAuthorization(AuthorizationContext filterContext) {
           if(filterContext == null) {
               throw new ArgumentNullException(nameof(filterContext));
           }
   
           HttpContextBase httpContext = filterContext.HttpContext;
           HttpCookie cookie = httpContext.Request.Cookies[AntiForgeryConfig.CookieName];
           AntiForgery.Validate(cookie?.Value, httpContext.Request.Headers["__RequestVerificationToken"]);
       }
   }
   

3. Apply this attribute to the controller action that handles Dashboard callbacks:

   C#

   [DashboardValidateAntiForgeryToken]
   public class DashboardWithAntiForgeryTokenController : DevExpress.DashboardWeb.Mvc.DashboardController {
       static readonly DashboardConfigurator dashboardConfigurator;
       static DashboardWithAntiForgeryTokenController() {
           var dashboardInMemoryStorage = new DashboardInMemoryStorage();
           dashboardInMemoryStorage.RegisterDashboard("editId", 
               XDocument.Load(HostingEnvironment.MapPath(@"~/App_Data/PublicDashboard.xml")));
   
           dashboardConfigurator = new DashboardConfigurator();
           dashboardConfigurator.SetDashboardStorage(dashboardInMemoryStorage);
       }
   
       public DashboardWithAntiForgeryTokenController() : base(dashboardConfigurator) {
       }
   }
   

Spreadsheet, Rich Text Editor, and File Management

To protect against CSRF attacks when using File Manager, File Upload, Rich Text Editor, and Spreadsheet controls:

1. Generate an anti-forgery token on a page:

   @Html.AntiForgeryToken()
   

2. Add a client function that injects the token into the RequestVerificationToken HTTP request header.

   <script>
       function onBeforeSend(spreadsheet, e) {
           e.request.setRequestHeader("RequestVerificationToken", document.querySelector('input[name=__RequestVerificationToken]').value);
       }
   </script>
   

3. Pass the function name to the control’s BeforeSend client-side event to add the token to all HTTP requests.

   File Manager

   @Html.DevExpress().FileManager(settings => {
       settings.Name = "FileManager";
       settings.CallbackRouteValues = new { Controller = "Home", Action = "FileManagerPartial" };
       settings.ClientSideEvents.BeforeSend = "onBeforeSend";
   }).BindToFolder(Model).GetHtml()
   

   File Upload

   @Html.DevExpress().UploadControl(settings => {
       settings.Name = "UploadControl";
       settings.ClientSideEvents.BeforeSend = "onBeforeSend";
   }).GetHtml()
   

   Rich Text Editor

   @Html.DevExpress().RichEdit(settings => {
       settings.Name = "RichEdit";
       settings.CallbackRouteValues = new { Controller = "Home", Action = "RichEditPartial" };
       settings.ClientSideEvents.BeforeSend = "onBeforeSend";
   }).Open(Server.MapPath("~/App_Data/Documents/Overview.rtf")).GetHtml()
   

   Spreadsheet

   @Html.DevExpress().Spreadsheet(settings => {
       settings.Name = "Spreadsheet";
       settings.CallbackRouteValues = new { Controller = "Home", Action = "SpreadsheetPartial" };
       settings.ClientSideEvents.BeforeSend = "onBeforeSend";
   }).GetHtml()
   

4. Implement IHttpModuleSubscriber to validate the RequestVerificationToken HTTP request header against the anti‑forgery cookie token. Reject all unsafe requests that fail validation.

   public class AntiforgeryOfficeHttpModuleSubscriber : IHttpModuleSubscriber {
        bool IsUploadRequest(HttpRequest request) {
            return request.Path.EndsWith(DevExpress.Web.Internal
                .HttpUtils.UploadProgressHttpHandlerPagePath,
                StringComparison.OrdinalIgnoreCase);
        }
   
        bool IsOfficeRequest(HttpRequest request) {
            return request.Path.EndsWith(DevExpress.Web.Office.Internal.
                DocumentWorkSessionManagerSubscriber.HandlerName,
                StringComparison.OrdinalIgnoreCase);
        }
   
        public bool RequestRecipient(HttpRequest request, RequestEvent requestEvent) {
            return requestEvent == RequestEvent.BeginRequest
                && (IsOfficeRequest(request)
                || IsUploadRequest(request));
        }
   
        public void ProcessRequest() {
            HttpContext context = HttpContext.Current;
            HttpRequest request = context.Request;
   
            if(!IsUnsafeMethod(request)) return;
   
            if(!TryValidateAntiforgery(request, out var error)) {
                context.Response.StatusCode = 400;
                context.Response.TrySkipIisCustomErrors = true;
                context.Response.ContentType = "text/plain";
                context.Response.Write("Invalid anti-forgery token.");
                if(!string.IsNullOrEmpty(error))
                    context.Response.Write(" " + HttpUtility.HtmlEncode(error));
                context.ApplicationInstance.CompleteRequest();
            }
        }
   
        bool IsUnsafeMethod(HttpRequest r) {
            return !(r.HttpMethod == "GET"
                     || r.HttpMethod == "HEAD"
                     || r.HttpMethod == "OPTIONS"
                     || r.HttpMethod == "TRACE");
        }
   
        bool TryValidateAntiforgery(HttpRequest request, out string error) {
            error = null;
            try {
                string headerToken = request.Headers["RequestVerificationToken"];
                string cookieToken = request.Cookies[System.Web.Helpers.AntiForgeryConfig.CookieName]
                                     ?.Value;
                System.Web.Helpers.AntiForgery.Validate(cookieToken, headerToken);
                return true;
            }
            catch(System.Web.Mvc.HttpAntiForgeryException ex) {
                error = ex.Message;
                return false;
            }
        }
   }
   

5. Register the AntiforgeryOfficeHttpModuleSubscriber at application startup so the DevExpress module can invoke it for matching requests.

   void Application_Start(object sender, EventArgs e) {
       ASPxHttpHandlerModule.Subscribe(new AntiforgeryOfficeHttpModuleSubscriber());
   }