I understand that DNN provides built-in protection against CSRF attacks through ViewState (with userkey).

However, I wonder if that security is automatically integrated on every page, or should I integrate my own CSRF protection when I develop a custom module?

I tried checking the security guide, but that link seems broken (link is listed here).

My set-up is the following:

I created a module, which calls a Web API service serverside. The user interacts only with the module, the module's code behind calls a Web API. This Web API has nothing to do with DNN, it is a separate API.

So the only attack vector is the module's front-end, which is by default adequately secured against CSRF, right? I understand that, if I would call a service directly, I would need to implement an anti-CSRF token myself, but as the call to my Web API leaves from server-side, there's no need to implement it myself?

With another account, but I'm the TS.

I have looked into this issue again, and there does seem to be something vulnerable. 

Set-up: we have implemented a module, and inserted it on the website. This module does some processing in the back-end, but that is not relevant.

Scenario:

- I open this page in a browser, and intercept the submission with Fiddler
- I open the same page in a browser as another user, and note my session id on a piece of paper
- IOn the PC with Fiddler open, I replay and intercept the first request. I change the session id with the one I wrote on a piece of paper, and submit.

=> The request is approved and effectively executed.

 

This seems like CSRF to me. So I need some custom protection for all of my modules to protect against that?