add benchmark for csrf

Author: DeagleGross

build/trend-scenarios.yml

@@ -99,6 +99,10 @@ parameters:
     arguments: --scenario antiforgery-validation $(antiforgeryJobs) --property scenario=AntiforgeryTokenValidation
   - displayName: Antiforgery Token Generation
     arguments: --scenario antiforgery-generation $(antiforgeryJobs) --property scenario=AntiforgeryTokenGeneration
+  - displayName: CSRF Accepted
+    arguments: --scenario csrf-accepted $(antiforgeryJobs) --property scenario=CsrfAccepted
+  - displayName: CSRF Rejected
+    arguments: --scenario csrf-rejected $(antiforgeryJobs) --property scenario=CsrfRejected
 
 # TLS
 

scenarios/antiforgery.benchmarks.yml

@@ -5,6 +5,7 @@ imports:
 variables:
   serverPort: 5000
   serverScheme: http
+  scenario: antiforgery
 
 jobs:
   antiforgerybenchmarks:
@@ -13,7 +14,7 @@ jobs:
       branchOrCommit: main
       project: src/BenchmarksApps/Antiforgery/Antiforgery.csproj
     readyStateText: Application started.
-    arguments: "--urls {{serverScheme}}://{{serverAddress}}:{{serverPort}}"
+    arguments: "--urls {{serverScheme}}://{{serverAddress}}:{{serverPort}} --scenario {{scenario}}"
 
 scenarios:
 
@@ -45,4 +46,28 @@ scenarios:
     load:
       job: wrk
       variables:
-        path: /noOp
+        path: /noOp
+
+  csrf-accepted:
+    application:
+      job: antiforgerybenchmarks
+      variables:
+        scenario: csrf
+    load:
+      job: wrk
+      variables:
+        path: /csrf
+        script: https://raw.githubusercontent.com/aspnet/Benchmarks/main/src/BenchmarksApps/Antiforgery/scripts/wrk-csrf.lua
+        scriptArguments: same-origin
+
+  csrf-rejected:
+    application:
+      job: antiforgerybenchmarks
+      variables:
+        scenario: csrf
+    load:
+      job: wrk
+      variables:
+        path: /csrf
+        script: https://raw.githubusercontent.com/aspnet/Benchmarks/main/src/BenchmarksApps/Antiforgery/scripts/wrk-csrf.lua
+        scriptArguments: cross-site

src/BenchmarksApps/Antiforgery/Program.cs

@@ -2,32 +2,55 @@
 
 var builder = WebApplication.CreateBuilder(args);
 builder.Logging.ClearProviders();
-builder.Services.AddAntiforgery(options => options.HeaderName = "XSRF-TOKEN");
+
+// "csrf" exercises the auto-injected cross-origin (Sec-Fetch) CSRF protection in isolation,
+// so the token-based antiforgery services/middleware are left out to avoid overriding its verdict.
+var scenario = builder.Configuration["scenario"] ?? "antiforgery";
+var tokenAntiforgeryEnabled = !string.Equals(scenario, "csrf", StringComparison.OrdinalIgnoreCase);
+
+if (tokenAntiforgeryEnabled)
+{
+    builder.Services.AddAntiforgery(options => options.HeaderName = "XSRF-TOKEN");
+}
 
 var app = builder.Build();
-app.UseAntiforgery();
+
+if (tokenAntiforgeryEnabled)
+{
+    app.UseAntiforgery();
+}
 
 app.MapGet("/", () => Results.Ok("hello world!"));
-app.MapGet("/noOp", (HttpContext ctx, IAntiforgery antiforgery) => Results.Ok());
 
-// GET https://localhost:55471/auth
-app.MapGet("/auth", (HttpContext ctx, IAntiforgery antiforgery) =>
-{
-    var token = antiforgery.GetAndStoreTokens(ctx);
-    ctx.Response.Headers.Append("XSRF-TOKEN", token.RequestToken!);
-    return Results.Ok();
-});
+// POST endpoint guarded only by the auto-injected cross-origin CSRF protection.
+// Sec-Fetch-Site: same-origin/none => 200; cross-site/same-site => 400.
+app.MapPost("/csrf", () => Results.Ok());
 
-// POST https://localhost:55471/validateToken
-app.MapPost("/validateToken", async (HttpContext ctx, IAntiforgery antiforgery) =>
+// Token-based antiforgery endpoints. These depend on IAntiforgery, which is only
+// registered when the token-based antiforgery services are added above.
+if (tokenAntiforgeryEnabled)
 {
-    // HttpContext is expected to have 2 headers:
-    // 1) antiforgery token ("XSRF-TOKEN");
-    // 2) cookie token ("Cookie") with value of `.AspNetCore.Antiforgery.<unique-sequence>=<cookie_header>`
+    app.MapGet("/noOp", (HttpContext ctx, IAntiforgery antiforgery) => Results.Ok());
+
+    // GET https://localhost:55471/auth
+    app.MapGet("/auth", (HttpContext ctx, IAntiforgery antiforgery) =>
+    {
+        var token = antiforgery.GetAndStoreTokens(ctx);
+        ctx.Response.Headers.Append("XSRF-TOKEN", token.RequestToken!);
+        return Results.Ok();
+    });
+
+    // POST https://localhost:55471/validateToken
+    app.MapPost("/validateToken", async (HttpContext ctx, IAntiforgery antiforgery) =>
+    {
+        // HttpContext is expected to have 2 headers:
+        // 1) antiforgery token ("XSRF-TOKEN");
+        // 2) cookie token ("Cookie") with value of `.AspNetCore.Antiforgery.<unique-sequence>=<cookie_header>`
 
-    await antiforgery.ValidateRequestAsync(ctx);    
-    return Results.Ok();
-});
+        await antiforgery.ValidateRequestAsync(ctx);
+        return Results.Ok();
+    });
+}
 
 await app.StartAsync();
 Console.WriteLine("Application started.");

src/BenchmarksApps/Antiforgery/scripts/wrk-csrf.lua

@@ -0,0 +1,11 @@
+-- The header value is taken from the first script argument (wrk ... -- <value>),
+-- e.g. "same-origin" (accepted) or "cross-site" (rejected). Defaults to same-origin.
+
+wrk.method = "POST"
+
+local secFetchSite = "same-origin"
+if arg and arg[1] then
+   secFetchSite = arg[1]
+end
+
+wrk.headers["Sec-Fetch-Site"] = secFetchSite