Question

I am developing an httphandler to process some requests in Web Forms (NOT in MVC).
How could I implement Anti Cross Site Scripting (like antiforgery in MVC)?
I want to know mre about the antiforgery mechanism in MVC.

Answer 1

If you can access the Page, you can use the ViewStateUserKey property of the Page. Here is an example of how to do this from within the page, but you will get the idea:

protected void Page_Init(object sender, EventArgs e)
{
    // Validate whether ViewState contains the MAC fingerprint
    // Without a fingerprint, it's impossible to prevent CSRF.
    if (!this.Page.EnableViewStateMac)
    {
        throw new InvalidOperationException(
            "The page does NOT have the MAC enabled and the view" +
            "state is therefore vulnerable to tampering.");
    }

    this.ViewStateUserKey = this.Session.SessionID;
}

While the ViewStateUserKey is pretty safe, there are some short comes with this. You can read more about that here.