asp.net and Cross Site Request Forgery

Question

We recently ran an Appscan aganist an application and on a few pages the report shows: The following changes were applied to the original request:

• Set HTTP header to 'http://bogus.referer.ibm.com'
  Reasoning:
  The same request was sent twice in different sessions and the same response was received. This shows that none of the parameters are dynamic (session identifiers are sent only in cookies) and therefore that the application is vulnerable to this issue.

I'm a bit confused on how to handle this, should i just look at the Request.UrlReferrer and make sure it's the same host as what's in the URL or is there a better way to handle this?

Thanks.

Answer 1

The Referrer header can be spoofed quite easily. You need to use CSRF tokens (I recommend the Synchronizer Token Pattern) that will prove the origination of the request. There is an awesome resource at OWASP that you should definitely read. Good luck!