CSRF markup fix - asp.net

Question

I have a fortify result saying that the following line needs a secret to prevent CSRF
<form id ="form1test1" runat="server">
I have a random GUID being generated on Page Load, I want to compare it, when the form posts.
I have seen in classic asp putting the token in the action as a query string
I am trying:
<form "form1test1" runat="server"
action='<%# string.Concat(Eval("login.aspx/?Token="),"",Eval(Session["Token"].ToString()))%> '> >
Best I get is a print out of the text but not the values, not doing this in the code behind does not fix the finding in fortify
trying for something like
<form "form1test1" runat="server" action="login.aspx/?Token=12345DEF">

Answer 1

A better way to prevent CSRF attacks (it's working on my projects), is to implement it in your master pages, like this:
Add new Class that will handle the CSRF Validations for you:
public class CsrfHandler
{
public static void Validate(Page page, HiddenField forgeryToken)
{
if (!page.IsPostBack)
{
Guid antiforgeryToken = Guid.NewGuid();
page.Session["AntiforgeryToken"] = antiforgeryToken;
antiforgery.Value = antiforgeryToken.ToString();
}
else
{
Guid stored = (Guid)page.Session["AntiforgeryToken"];
Guid sent = new Guid(antiforgery.Value);
if (sent != stored)
{
// you can throw an exception, in my case I'm just logging the user out
page.Session.Abandon();
page.Response.Redirect("~/Default.aspx");
}
}
}
}
Then implement this in your master pages:
MyMasterPage.Master.cs:
protected void Page_Load(object sender, EventArgs e)
{
CsrfHandler.Validate(this.Page, forgeryToken);
...
}
MyMaster.Master:
<form id="form1" runat="server">
<asp:ScriptManager ID="ScriptManager1" runat="server"></asp:ScriptManager>
<asp:HiddenField ID="forgeryToken" runat="server"/>
...
</form>
Hope you'll find this useful.