ViewState and CSRF

Today, me and my colleagues- Chintan and Ronnie were having a long discussion about ViewState's ability to thwart CSRF attacks. While Chintan's argument was that CSRF is possible even the application is implementing ViewState, Ronnie's thought was it's virtually impossible to launch a CSRF attack on ViewState enabled application. My idea was that it's not impossible but very difficult and takes a great expertise to launch the attack. We also saw various articles were mentioning the ViewState as a countermeasures to CSRF, at the same time they were not denying the fact that this can also be circumvented.
For sake of doing some research over topic I stumbled upon some articles and came to some conclusion:
When attempting to exploit a CSRF issue, the attacker will try to remove the viewstate from the page, since often viewstate is not required for a page to function properly. If the page complains when the viewstate is removed, the attacker will try logging into the application, visiting the page, and then copying the viewstate from the page into the CSRF exploit. Depending on the application, ASP.Net may accept the viewstate on behalf of the victim. Viewstate may be omitted or substituted because not all applications depend on the viewstate being present or initialized.

To mitigate the CSRF weaknesses, ASP.Net 1.1 introduced the Page.ViewStateUser-Key property. The property can be used to add entropy to the viewstate. When ASP.Net receives a postback it will use the ViewStateUserKey along with the validation key to calculate the page viewstate’s HMAC. By adding a unique value per user per page, it will not be possible for an attacker to substitute his own viewstate when creating a CSRF exploit.

Now starting .Net 1.1 the applications are 'almost' secure against the CSRF. Having said that it is also recommended to implement anti-CSRF token in the application. That will make the application's defense against CSRF more robust.

Your Cookie attribute will be overwritten

In one of the applications , there was a vulnerability-they were not marking the cookie as 'HTTPOnly' but marking it as 'Secure'. I recommended them to as a best practice, flag the cookie as 'HTTPOnly' as well.

Set-Cookie: JSESSIONID=AJ122112KJYS.......; secure

Now they fixed it- They were setting the Cookie (Set-Cookie) as soon as the application loads in the browser and marking it as 'Secure'. Once the user is successfully authenticated they were regenerating the session ID and again (Set-Cookie) and this time marking it as 'HTTPOnly' only.

Set-Cookie: JSESSIONID=7H8TKLSDOPC56.......; HTTPOnly

Fine! but really? They were using the Set-Cookie header two times. First time they were marking it as 'secure' and again after regenerating it marking it as 'HTTPOnly'. Now this was the problem. Setting the cookie with Set-Cookie again overwrites the earlier attribute of Cookie. That means if you are setting cookie as 'secure and again setting with some other attribute , for example, 'HTTPOnly' then your cookie is no longer 'secure' now.

So best practices is flag it simultaneously with both the attributes:

Set-Cookie: JSESSIONID=7H8TKLSDOPC56.......; HTTPOnly; secure

Nice link: http://code.google.com/p/browsersec/wiki/Part2#Same-origin_policy_for_cookies
Thanks to Sripathi Krishnan for sharing this.
It says:Overwriting cookies: if a new cookie with the same NAME, domain, and path as an existing cookie is encountered, the old cookie is discarded. Otherwise, even if a subtle difference exists (e.g., two distinct domain= values in the same top-level domain), the two cookies will co-exist, and may be sent by the client at the same time as two separate pairs in Cookie headers, with no additional information to help resolve the conflict.

Open Redirection-How to Secure it

When the OWASP has also included this issue in it's Top Ten 2010 list and also I have been finding lots of unvalidated redirects in the applications assessed everyday, I was just giving standard recommendation to developers to go for whitelisting approach. Include a set of valid domains- to which only your users should be forwarded- into your application. Once you have identified a “whitelist” of trusted domains, put the list in a configuration file on the server or database. From a secure coding perspective, the redirection servlet or script should not take a URL as a parameter. Instead, require that the servlet accepts an index that maps to the list of trusted domains.
But as I am not very good in coding I was not able to assist them in coding.
Eventually today I stumbled upon a very nice article here. It describes the best practices for redirecting users to trusted domains and how to 'code' that.
Please visit: http://mikeware.us/goodcode/?p=260