csrf vulnerability testing

Question

I have hosted a small MVC application on IIS using localhost on machine A. I have the following html in the home page. The domain here is the IP address of machine B for testing purposes.

<div class="row">
    <div class="col-md-4">
        <h2 class="jumbotron">You have won a prize!</h2>
        <p>
            To redeem your prize. Click this button.
        </p>
        <form action="http://target_IP_address/eline/webController/Populate" method="POST">
            <input type="hidden" name="dateF" value="3/16/2022 3:01:26 PM" />
            <input type="hidden" name="dateT" value="3/17/2022 3:01:26 PM" />
            <input type="submit" class="btn btn-primary btn-lg" value="Give me my prize" />
        </form>
    </div>  
</div>

Now, in machine B I am logged into the vulnerable website. I then click on a link that takes me to the website hosted on machine A. When I arrive to the website, I click on the the "submit" button. Here is where my confusion begins. There is no record of this request being made in machine B. I do see the request in machine A. This is what I see.

I was under the impression that I would see the request on machine B. Since I am seeing it in machine A I am sure I am messing up somehow. The fix I implemented to check csrf attacks is supposed to attach a custom header (csrf-detected:1) to the response if the request is missing another custom header (csrf-token:some unique token). Since this header does not show up in the "Response Headers" section, I'm thinking the check did not occur before the Populate method in the webController. Can anyone point out what I'm doing wrong?

Answer 1

To help prevent CSRF attacks, ASP.NET MVC uses anti-forgery tokens, also called request verification tokens.

---

1. The client requests an HTML page that contains a form.
2. The server includes two tokens in the response. One token is sent as a cookie. The other is placed in a hidden form field. The tokens are generated randomly so that an adversary cannot guess the values.
3. When the client submits the form, it must send both tokens back to the server. The client sends the cookie token as a cookie, and it sends the form token inside the form data. (A browser client automatically does this when the user submits the form.)
4. If a request does not include both tokens, the server disallows the request.

---

To add the anti-forgery tokens to a Razor page, use the HtmlHelper.AntiForgeryToken helper method:

@using (Html.BeginForm("Manage", "Account")) {
    @Html.AntiForgeryToken()
}

This method adds the hidden form field and also sets the cookie token.