Help required to fix CWE-352 (CSRF) vulnerability in Asp.Net

LZhang172972 (Community Member) asked a question.

Hi,

We are applying this practice of CSRF as:

Generate a random key and store it in cookie
Use Double Submit Cookie approach to prevent CSRF. This is to get random key value from cookie, and copy to http header and at the back end validates that random id in cookie and header match.

But in Veracode scan, we got this CWE 352 flaws. Just wondering what is likely being missed for our approach. Thanks in advance.

GThreepwood (Community Member)
3 years ago
I would recommend checking out the CWE-352 Topic — there's a ton of similar questions that have been answered like this one which might have the answers you're looking for 🙂
Expand Post