Question

When defining the ValidateAntiForgeryToken attribute. What level of complexity should be given to the salt?

For example is an alpha-numeric over X number of characters characters good? Should there be symbols as well.

[ValidateAntiForgeryToken(Salt = "How complex is good")]
public virtual ActionResult SaveDetail(UserDetails details)
{
.
.
.
}

Answer 1

I think it’s a matter of salt length rather than character types. Simply put, the longer the salt, the harder the AntiForgeryToken will be to crack. Modern methods such as md5-crypt and bcrypt use salts of 48 and 128 bits, respectively. Perhaps you want to follow their lead.

If you’re really concerned, add a different salt to each view. This will provide added security to your site as hackers won’t be able reuse a compromised token from view to view. Hopefully that makes sense.

Sanderson speak to this in this post.