BI Dashboard for ASP.NET Core - How to Prevent Cross-Site Request Forgery (CSRF) Attacks

The following example applies antiforgery request validation to the DevExpress ASP.NET Core Dashboard control.

Example Overview

Follow the steps below to apply antiforgery request validation.

Configure a custom dashboard controller

1. Create a custom dashboard controller. If you already have a custom controller, you can skip this step.

namespace AspNetCoreDashboardPreventCrossSiteRequestForgery.Controllers {
    public class CustomDashboardController : DashboardController {
        public CustomDashboardController(CustomDashboardConfigurator configurator, IDataProtectionProvider dataProtectionProvider = null): base(configurator, dataProtectionProvider) { 
        }
    }    
}

2. Change default routing to use the created controller.

app.UseEndpoints(endpoints => {
	endpoints.MapDashboardRoute("dashboardControl", "CustomDashboard");
	// ...
});

3. Specify the controller name in the Web Dashboard settings.

@(Html.DevExpress().Dashboard("dashboardControl1")
     ...
    .ControllerName("CustomDashboard")
)

Add validation for AntiforgeryToken

1. Add the Antiforgery service.

services.AddAntiforgery(options => {
	// Set Cookie properties using CookieBuilder properties†.
	options.FormFieldName = "X-CSRF-TOKEN";
	options.HeaderName = "X-CSRF-TOKEN";
	options.SuppressXFrameOptionsHeader = false;
});

2. Add the AutoValidateAntiforgeryToken attribute to the custom controller.

[AutoValidateAntiforgeryToken]
public class CustomDashboardController : DashboardController {
	// ...
}   

3. Configure the Web Dashboard control's backend options.

@inject Microsoft.AspNetCore.Antiforgery.IAntiforgery Xsrf
 
@(Html.DevExpress().Dashboard("dashboardControl1")
    ...
    .ControllerName("CustomDashboard")
    .BackendOptions(backendOptions => {
        backendOptions.RequestHttpHeaders(headers => {
            headers.Add("X-CSRF-TOKEN", Xsrf.GetAndStoreTokens(HttpContext).RequestToken);
        });
    })
)

Files to Review

• CustomDashboardController.cs
• Index.cshtml
• Startup.cs

Documentation

• Web Dashboard - Security Considerations
• Prevent Cross-Site Request Forgery (XSRF/CSRF) attacks in ASP.NET Core
• CA3147: Mark verb handlers with ValidateAntiForgeryToken

More Examples

• ASP.NET MVC Dashboard - How to Prevent Cross-Site Request Forgery (CSRF) Attacks