Asp.net CSRF 跨站点请求伪造实现代码

protected void Page_Load(object sender, EventArgs e)
        {
            string token = CreateToken();
            PutTokenToClient(token);
            SaveTokenInServer(token);
        }

        protected void ButtonDosomething_Click(object sender, EventArgs e)
        {
            string token = GetTokenFromRequest();
            //需要csrf保护的地方就check才放行
            if (TokenIsOK(token))
            {
                //todo: go
            }
            else
            {
                //todo: block
            }
        }

        private string GetTokenFromRequest()
        {
            //todo 从请求中得到coken，一般为URL QueryString或表单元素
            throw new NotImplementedException();
        }

        private void PutTokenToClient(string token)
        {
            //todo 将其保存到前台，如请求的url，或隐藏的input
        }

        private void SaveTokenInServer(string token)
        {
            //一般保存在session中
            Session["CRSFToken"] = token;
        }

        private bool TokenIsOK(string token)
        {
            string tokenInServer = Session["CRSFToken"].ToString();
            return tokenInServer == token ? true : false;
        }

        public string _salt = "asdfkl@,.;#sss13131313";

        public string CreateToken()
        {
            return MD5(Session.SessionID + _salt);
        }

        private void ClearToken()
        {
            Session["CRSFToken"] = string.Empty;
        }

        private string MD5(string p)
        {
            throw new NotImplementedException();
    }