1
00:00:01,940 --> 00:00:02,990
[Autogenerated] when we take another look

2
00:00:02,990 --> 00:00:05,810
at the form specifically at the cookies

3
00:00:05,810 --> 00:00:08,480
with the F 12 tools of the browser, we can

4
00:00:08,480 --> 00:00:10,650
see there's another cookie. They're called

5
00:00:10,650 --> 00:00:14,200
A S P net, and the forgery value is a long

6
00:00:14,200 --> 00:00:17,500
string Notice that it has same site said

7
00:00:17,500 --> 00:00:20,710
too strict. And when I examined the HTML

8
00:00:20,710 --> 00:00:23,350
elements of the form, there's an input we

9
00:00:23,350 --> 00:00:26,670
did a specifically render. It's hidden and

10
00:00:26,670 --> 00:00:30,000
it has the name request verification token

11
00:00:30,000 --> 00:00:32,360
in a Speedo ninth Corps cookie and hit an

12
00:00:32,360 --> 00:00:35,770
input are automatically generated if you

13
00:00:35,770 --> 00:00:38,790
render a form with Attack Helper in non

14
00:00:38,790 --> 00:00:41,170
core a Speedo net, you have to explicitly

15
00:00:41,170 --> 00:00:45,240
render these by using this a C mail helper

16
00:00:45,240 --> 00:00:48,130
cookie and hit an input Are there as anti

17
00:00:48,130 --> 00:00:51,290
CSR F measures for both NBC and raise your

18
00:00:51,290 --> 00:00:55,070
pages value from the form and the value of

19
00:00:55,070 --> 00:00:58,540
the cookie are cryptographic Lee linked.

20
00:00:58,540 --> 00:01:00,890
When the form gets submitted, a check and

21
00:01:00,890 --> 00:01:04,100
be done to see if both coats are still

22
00:01:04,100 --> 00:01:07,590
present and unchanged. The checking is an

23
00:01:07,590 --> 00:01:10,370
explicit step to take for both a Speedo

24
00:01:10,370 --> 00:01:13,460
net core and a speed of developers. The

25
00:01:13,460 --> 00:01:15,700
only thing we have to do this place the

26
00:01:15,700 --> 00:01:18,870
validate anti forgery token attributes on

27
00:01:18,870 --> 00:01:21,430
the post method. When I now show the form

28
00:01:21,430 --> 00:01:24,070
again and start manipulating one of the

29
00:01:24,070 --> 00:01:27,420
coats and then submit theeighty TP status,

30
00:01:27,420 --> 00:01:30,600
code 400 has generated and the form post

31
00:01:30,600 --> 00:01:34,540
is not accepted. How does this help this

32
00:01:34,540 --> 00:01:37,470
year's or F? Remember the demo I showed

33
00:01:37,470 --> 00:01:40,740
you in the first clip? The female form was

34
00:01:40,740 --> 00:01:44,010
only Attackers website. It would be very

35
00:01:44,010 --> 00:01:46,200
difficult for the attacker to generate a

36
00:01:46,200 --> 00:01:48,030
village goat to put in the Haight. An

37
00:01:48,030 --> 00:01:51,520
import off the form and the code is also

38
00:01:51,520 --> 00:01:54,260
cryptographic. Lee generated using keys

39
00:01:54,260 --> 00:01:56,200
that are only known at the site that

40
00:01:56,200 --> 00:01:58,510
received the post. And even if Attackers

41
00:01:58,510 --> 00:02:00,990
could somehow get to these keys, they must

42
00:02:00,990 --> 00:02:02,950
also managed to set a cookie for the

43
00:02:02,950 --> 00:02:06,050
attack site. It is very unlikely they will

44
00:02:06,050 --> 00:02:09,630
be able to do both things. It's important

45
00:02:09,630 --> 00:02:13,100
to remember that anti forgery tokens only

46
00:02:13,100 --> 00:02:16,000
work with forms, but there are other ways

47
00:02:16,000 --> 00:02:24,000
to do. C S R F attacks. I'm talking about these as well as best breakfast sis. Next

