title: Protect against CSRF attacks in ASP.NET Web Forms without Master Pages
body: <p>I'm reviewing the security of an ASP.NET website that is about 7 years old. At the time the site was created the Microsoft guidance was to add the following to a common Base Page (inherited by all code behind pages):</p>
  <pre><code>Protected Overrides Sub OnInit(ByVal e As System.EventArgs)
      MyBase.OnInit(e)
  
      If Request.IsSecureConnection = True Then
          ViewStateUserKey = Session.SessionID
      End If
  End Sub
  </code></pre>
  <p>This advice comes from the following <a href="https://docs.microsoft.com/en-us/previous-versions/dotnet/articles/ms972969%28v=msdn.10%29" rel="nofollow noreferrer">MSDN Article</a> from 2005.</p>
  <p>My question is if this is still a valid and effective technique to protect against CSRF attacks.</p>
  <p>Note, I read an <a href="https://stackoverflow.com/questions/29939566/preventing-cross-site-request-forgery-csrf-attacks-in-asp-net-web-forms">SO question</a> about this topic, but it appears the Visual Studio 2012+ project auto generated protection for CSRF are added to Master Pages. The site I'm reviewing doesn't use Master Pages because of CSS conflicts, and it is not in scope to add Master Pages into the current update.</p>