Remove session binding to the CSRF token, as it is unnecessary for serverless services on the backend.

Author: claudiamurialdo

dotnet/src/dotnetcore/GxNetCoreStartup/CsrfHelper.cs

@@ -62,29 +62,4 @@ internal static void SetAntiForgeryTokens(IAntiforgery _antiforgery, HttpContext
 		}
 
 	}
-	public class SessionIdAntiforgeryAdditionalDataProvider : IAntiforgeryAdditionalDataProvider
-	{
-		static readonly ILog log = log4net.LogManager.GetLogger(typeof(SessionIdAntiforgeryAdditionalDataProvider));
-		public string GetAdditionalData(HttpContext context)
-		{
-			context.NewSessionCheck();
-			GXLogging.Debug(log, $"Setting session id as additional CSRF token data:", context.Session.Id);
-			return context.Session.Id.Trim();
-		}
-
-		public bool ValidateAdditionalData(HttpContext context, string additionalData)
-		{
-			if (context.IsNewSession())
-			{
-				return true;
-			}
-			else
-			{
-				bool validSession = context.Session.Id.Trim().CompareTo(additionalData.Trim()) == 0 ? true : false;
-				GXLogging.Warn(log, $"Session id in CSRF token ({additionalData}) does not match the current session id ({context.Session.Id})");
-				return validSession;
-			}
-		}
-	}
-
 }

dotnet/src/dotnetcore/GxNetCoreStartup/Startup.cs

@@ -253,7 +253,6 @@ public void ConfigureServices(IServiceCollection services)
 					options.HeaderName = HttpHeader.X_CSRF_TOKEN_HEADER;
 					options.SuppressXFrameOptionsHeader = false;
 				});
-				services.AddSingleton<IAntiforgeryAdditionalDataProvider, SessionIdAntiforgeryAdditionalDataProvider>();
 			}
 			services.AddDirectoryBrowser();
 			if (GXUtil.CompressResponse())

dotnet/src/dotnetframework/GxClasses/Helpers/CsrfHelper.cs

@@ -4,14 +4,11 @@
 using System.Web.Helpers;
 using GeneXus.Application;
 using GeneXus.Utils;
-using log4net;
 
 namespace GeneXus.Http
 {
 	internal class CSRFHelper
 	{
-		//AntiForgeryConfig.AdditionalDataProvider = new SessionIdAntiforgeryAdditionalDataProvider();
-		
 		[SecuritySafeCritical]
 		internal static void ValidateAntiforgery(HttpContext context)
 		{
@@ -53,22 +50,4 @@ static void ValidateAntiforgeryImpl(HttpContext context)
 			}
 		}
 	}
-
-	
-	public class SessionIdAntiforgeryAdditionalDataProvider : IAntiForgeryAdditionalDataProvider
-	{
-		static readonly ILog log = log4net.LogManager.GetLogger(typeof(SessionIdAntiforgeryAdditionalDataProvider));
-		public string GetAdditionalData(HttpContextBase context)
-		{
-			GXLogging.Debug(log, $"Setting session id as additional CSRF token data:", context.Session.SessionID);
-			return context.Session.SessionID.Trim();
-		}
-		[SecuritySafeCritical]
-		public bool ValidateAdditionalData(HttpContextBase context, string additionalData)
-		{
-			bool validSession = context.Session.SessionID.Trim().CompareTo(additionalData.Trim()) == 0 ? true : false;
-			GXLogging.Warn(log, $"Session id in CSRF token ({additionalData}) does not match the current session id ({context.Session.SessionID})");
-			return validSession;
-		}
-	}
 }