Question

to prevent CSRF I want to implement the Synchronizer Token Pattern in my classic asp application.

I understand that iIshould generate a token in session_onstart. What I do not get is how to generate such a token as it should be random and unique. So a simple Rnd() and randomize will not work, right?

Furthermore should it be hashed in any way? How?

Thanks for any hints…

Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet

Answer 1

You could use a GUID as token:-

Function GetGUID()

    GetGUID = CreateObject("Scriptlet.TypeLib").GUID 

End Function