記錄一下本身在MVC項目中如何防CSRF攻擊，直接上代碼

1.前端的處理：

 

2.後臺 

 1.）添加過濾器，哪裏用放哪裏

2.）須要驗證的方法上直接添加過濾器便可

大功告成

如下爲過濾器代碼塊

/// <summary>
/// ajax中加上AntiForgeryToken防止CSRF攻擊
/// </summary>
[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, Inherited = true, AllowMultiple = false)]
public class MyValidateAntiForgeryToken : AuthorizeAttribute
{
private readonly bool _ignore;
/// <summary>
/// 防僞安全屬性
/// </summary>
/// <param name="ignore">是否忽略安全驗證</param>
public MyValidateAntiForgeryToken(bool ignore = false)
{
this._ignore = ignore;
}

public override void OnAuthorization(AuthorizationContext filterContext)
{
if (filterContext == null)
throw new ArgumentNullException("filterContext");

if (_ignore)
return;

if (filterContext.IsChildAction)
return;

///只處理POST請求
if (!String.Equals(filterContext.HttpContext.Request.HttpMethod, "POST", StringComparison.OrdinalIgnoreCase))
return;

var request = filterContext.HttpContext.Request;var antiForgeryCookie = request.Cookies[AntiForgeryConfig.CookieName];var cookieValue = antiForgeryCookie != null ? antiForgeryCookie.Value : null;AntiForgery.Validate(cookieValue, request.Form["__RequestVerificationToken"]); //從cookies 和 Form中驗證防僞標記 }}