CODEWITHSUNDEEP
c#winformssecurityauthenticationtoken
Karandawov
Karandawov

Reputation: 93

Do I need CSRF tokens for WinForms?

If we are making a messenger program that requires a login and a password (and client and a server), then, I assume, we actually need a security token, exactly in the same way you would on the web.

In fact, if the client has a valid security token that it sends to the server to perform any action, then the fact that the token matched means that any action (even "delete my account") is valid (unless we have a really good hacker). Right?

Upvotes: 0

Views: 433

Answers (1)

Neil McGuigan
Neil McGuigan

Reputation: 48277

No, you don't. You only need csrf protection on web pages or http apis that are accessed using a web browser. It's a confused deputy attack, and the deputy is the browser. https://en.m.wikipedia.org/wiki/Confused_Deputy

If the remote login url is used by other apps that use a browser, then you would want csrf protection.

You do want to handle authentication and authorization correctly though. Please use a framework appropriate for your server environment. Hash passwords and use tls.

Upvotes: 1

Related Questions