Add CSRF benchmark (#2181)

Author: DeagleGross

build/trend-scenarios.yml

@@ -99,6 +99,10 @@ parameters:
     arguments: --scenario antiforgery-validation $(antiforgeryJobs) --property scenario=AntiforgeryTokenValidation
   - displayName: Antiforgery Token Generation
     arguments: --scenario antiforgery-generation $(antiforgeryJobs) --property scenario=AntiforgeryTokenGeneration
+  - displayName: CSRF Accepted
+    arguments: --scenario csrf-accepted $(antiforgeryJobs) --property scenario=AntiforgeryCsrfAccepted
+  - displayName: CSRF Rejected
+    arguments: --scenario csrf-rejected $(antiforgeryJobs) --property scenario=AntiforgeryCsrfRejected
 
 # TLS
 

scenarios/antiforgery.benchmarks.yml

@@ -5,6 +5,8 @@ imports:
 variables:
   serverPort: 5000
   serverScheme: http
+  scenario: antiforgery
+  debug: false
 
 jobs:
   antiforgerybenchmarks:
@@ -13,7 +15,7 @@ jobs:
       branchOrCommit: main
       project: src/BenchmarksApps/Antiforgery/Antiforgery.csproj
     readyStateText: Application started.
-    arguments: "--urls {{serverScheme}}://{{serverAddress}}:{{serverPort}}"
+    arguments: "--urls {{serverScheme}}://{{serverAddress}}:{{serverPort}} --scenario {{scenario}} --debug {{debug}}"
 
 scenarios:
 
@@ -45,4 +47,30 @@ scenarios:
     load:
       job: wrk
       variables:
-        path: /noOp
+        path: /noOp
+
+  csrf-accepted:
+    application:
+      job: antiforgerybenchmarks
+      variables:
+        scenario: csrf
+    load:
+      job: wrk
+      variables:
+        path: /csrf
+        script: https://raw.githubusercontent.com/aspnet/Benchmarks/main/src/BenchmarksApps/Antiforgery/scripts/wrk-csrf.lua
+        customHeaders:
+          - "Sec-Fetch-Site: same-origin"
+
+  csrf-rejected:
+    application:
+      job: antiforgerybenchmarks
+      variables:
+        scenario: csrf
+    load:
+      job: wrk
+      variables:
+        path: /csrf
+        script: https://raw.githubusercontent.com/aspnet/Benchmarks/main/src/BenchmarksApps/Antiforgery/scripts/wrk-csrf.lua
+        customHeaders:
+          - "Sec-Fetch-Site: cross-site"

src/BenchmarksApps/Antiforgery/Program.cs

@@ -1,33 +1,93 @@
 using Microsoft.AspNetCore.Antiforgery;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.Logging;
 
 var builder = WebApplication.CreateBuilder(args);
-builder.Logging.ClearProviders();
-builder.Services.AddAntiforgery(options => options.HeaderName = "XSRF-TOKEN");
+
+var debug = builder.Configuration.GetValue<bool>("debug");
+if (debug)
+{
+    builder.Logging.AddFilter("Microsoft", LogLevel.Warning);
+    builder.Logging.AddFilter("Microsoft.AspNetCore.Antiforgery.CsrfProtectionMiddleware", LogLevel.Debug);
+}
+else
+{
+    builder.Logging.ClearProviders();
+}
+
+// "csrf" exercises the auto-injected cross-origin (Sec-Fetch) CSRF protection in isolation,
+// so the token-based antiforgery services/middleware are left out to avoid overriding its verdict.
+var scenario = builder.Configuration["scenario"] ?? "antiforgery";
+var tokenAntiforgeryEnabled = !string.Equals(scenario, "csrf", StringComparison.OrdinalIgnoreCase);
+Console.WriteLine($"Scenario: '{scenario}'. Token-based antiforgery enabled: {tokenAntiforgeryEnabled}.");
+
+if (tokenAntiforgeryEnabled)
+{
+    builder.Services.AddAntiforgery(options => options.HeaderName = "XSRF-TOKEN");
+}
 
 var app = builder.Build();
-app.UseAntiforgery();
 
-app.MapGet("/", () => Results.Ok("hello world!"));
-app.MapGet("/noOp", (HttpContext ctx, IAntiforgery antiforgery) => Results.Ok());
+if (debug)
+{
+    var requestCount = 0;
+    app.Use(async (context, next) =>
+    {
+        var n = Interlocked.Increment(ref requestCount);
+        if (n <= 20)
+        {
+            var request = context.Request;
+            Console.WriteLine($"[debug] #{n} {request.Method} {request.Path}{request.QueryString}");
+            foreach (var header in request.Headers)
+            {
+                Console.WriteLine($"[debug] #{n}   {header.Key}: {header.Value}");
+            }
+        }
 
-// GET https://localhost:55471/auth
-app.MapGet("/auth", (HttpContext ctx, IAntiforgery antiforgery) =>
+        await next(context);
+
+        if (n <= 20)
+        {
+            Console.WriteLine($"[debug] #{n} -> {context.Response.StatusCode}");
+        }
+    });
+}
+
+if (tokenAntiforgeryEnabled)
 {
-    var token = antiforgery.GetAndStoreTokens(ctx);
-    ctx.Response.Headers.Append("XSRF-TOKEN", token.RequestToken!);
-    return Results.Ok();
-});
+    app.UseAntiforgery();
+}
+
+app.MapGet("/", () => Results.Ok("hello world!"));
 
-// POST https://localhost:55471/validateToken
-app.MapPost("/validateToken", async (HttpContext ctx, IAntiforgery antiforgery) =>
+// POST endpoint guarded only by the auto-injected cross-origin CSRF protection.
+app.MapPost("/csrf", ([FromForm] string name) => Results.Ok());
+
+// Token-based antiforgery endpoints. These depend on IAntiforgery, which is only
+// registered when the token-based antiforgery services are added above.
+if (tokenAntiforgeryEnabled)
 {
-    // HttpContext is expected to have 2 headers:
-    // 1) antiforgery token ("XSRF-TOKEN");
-    // 2) cookie token ("Cookie") with value of `.AspNetCore.Antiforgery.<unique-sequence>=<cookie_header>`
+    app.MapGet("/noOp", (HttpContext ctx, IAntiforgery antiforgery) => Results.Ok());
+
+    // GET https://localhost:55471/auth
+    app.MapGet("/auth", (HttpContext ctx, IAntiforgery antiforgery) =>
+    {
+        var token = antiforgery.GetAndStoreTokens(ctx);
+        ctx.Response.Headers.Append("XSRF-TOKEN", token.RequestToken!);
+        return Results.Ok();
+    });
+
+    // POST https://localhost:55471/validateToken
+    app.MapPost("/validateToken", async (HttpContext ctx, IAntiforgery antiforgery) =>
+    {
+        // HttpContext is expected to have 2 headers:
+        // 1) antiforgery token ("XSRF-TOKEN");
+        // 2) cookie token ("Cookie") with value of `.AspNetCore.Antiforgery.<unique-sequence>=<cookie_header>`
 
-    await antiforgery.ValidateRequestAsync(ctx);    
-    return Results.Ok();
-});
+        await antiforgery.ValidateRequestAsync(ctx);
+        return Results.Ok();
+    });
+}
 
 await app.StartAsync();
 Console.WriteLine("Application started.");

src/BenchmarksApps/Antiforgery/scripts/wrk-csrf.lua

@@ -0,0 +1,5 @@
+-- POSTs a form to /csrf to exercise the auto-injected cross-origin (Sec-Fetch) CSRF protection.
+
+wrk.method = "POST"
+wrk.headers["Content-Type"] = "application/x-www-form-urlencoded"
+wrk.body = "name=benchmark"