title: Checkmarx XSRF issue
body: <p>Checkmarx is complaining about an XSRF issue in our web application. We are using ASP.NET web forms with framework 4.0 (not MVC)</p>
  
  <p>Checkmarx said: <em>Method btnSubmit_Click at line 1760 of \ABC.aspx.vb gets a parameter from a user request URL from element text. This parameter value flows through the code and is eventually used to modify database contents. The application does not require renewed user authentication for the request. This may enable Cross-Site Request Forgery (XSRF).</em></p>
  
  <p>Any idea of how to prevent XSRF from ASP.NET Webform application?</p>
  
  <p>We have tried a lot of solutions but none of them pass Checkmarx:
  Here are some things we tried:<br>
  <a href="https://software-security.sans.org/developer-how-to/developer-guide-csrf" rel="nofollow noreferrer">https://software-security.sans.org/developer-how-to/developer-guide-csrf</a><br>
  or<br></p>
  
  <p><a href="http://willseitz-code.blogspot.com/2013/06/cross-site-request-forgery-for-web-forms.html?m=1" rel="nofollow noreferrer">http://willseitz-code.blogspot.com/2013/06/cross-site-request-forgery-for-web-forms.html?m=1</a><br>
  or <br></p>
  
  <p><a href="https://security.stackexchange.com/questions/187740/two-solutions-for-csrf-on-owasp-for-asp-net-webforms">https://security.stackexchange.com/questions/187740/two-solutions-for-csrf-on-owasp-for-asp-net-webforms</a><br></p>
  
  <p>I think the solutions above should work and protect/prevent our web form from CSRF/XSRF risks, but why can Checkmarx not detect it? Is this a false positive?</p>