CODEWITHSUNDEEP
.netasp.net-mvccsrfssrf
user6769842
user6769842

Reputation: 27

How to fix Server-side Request Forgery x2 in ASP.NET MVC?

How to maintain a whitelist of externally requested services and hosts and block any interactions that do not appear on the whitelist?

I am looking for some code snippet for implementation of this.

Upvotes: -1

Views: 1331

Answers (1)

Saad Shaikh
Saad Shaikh

Reputation: 179

you can create an ActionFilter, which will check the request host/ip address, compare which db and block request when not found.

public class WhiteListedOnlyAttribute : ActionFilterAttribute
{
    public override void OnActionExecuting(ActionExecutingContext context)
    {
        var ipaddress = getHost(context);

        if(isValid(ipaddress))
        {
           base.OnActionExecuting(filterContext);
           return;
        }
        else
        {
           context.Result = RedirectToRouteResult(...);
        }
    }
}

Upvotes: 0

Related Questions