Blazor WebAssembly中的防止跨站点请求伪造 (XSRF/CSRF) 攻击

　　这里以asp.net core的服务端并且asp.net core托管客户端为例，跨域请求的参考其他跨域设置。

　　在asp.net core中，xsrf/csrf是通过验证http头或form表单中的字段来验证请求的。

　　在asp.net core的startup中注入如下服务以启用防止跨站点请求伪造 (xsrf/csrf) 攻击

            services.addantiforgery(options =>{ options.headername = "x-csrf-token-header"; options.formfieldname = "x-csrf-token-form"; });

　　启用如下中间件以在cookie中写入令牌

app.use(next=>context=> 
            {
                var tokens = antiforgery.getandstoretokens(context);
                context.response.cookies.append("xsrf-token", tokens.requesttoken,new cookieoptions() {httponly=false });
                return next(context);
            });

　　在blazor webassembly 客户端中注入jsruntime用于通过js读取cookie

@inject ijsruntime jsruntime

　　在form表单中附加令牌

  var token = await jsruntime.invokeasync<string>("getcookie", "xsrf-token");

        //form
        httpcontent httpcontent = new stringcontent($"x-csrf-token-form={token}", system.text.encoding.utf8);
        httpcontent.headers.contenttype = new system.net.http.headers.mediatypeheadervalue("application/x-www-form-urlencoded");

        using httpresponsemessage responsemessage = await http.postasync("weatherforecast", httpcontent);
        forecasts = await jsonserializer.deserializeasync<weatherforecast[]>(await responsemessage.content.readasstreamasync());

　　在header中附加令牌

   //header
        http.defaultrequestheaders.add("x-csrf-token-header", token);
        forecasts = await http.postjsonasync<weatherforecast[]>("weatherforecast", httpcontent);

 

参考：

源码：https://github.com/saber-wang/blazorappformtset