How to choose a salt value for ValidateAntiForgeryToken

Question

The anti-forgery token accepts a salt value. Is there any security concerns regarding choosing the salt, such as

• minimum length requirements
• cryptographically strong
• mix of alpha-numeric and other characters (like that of passwords)

Also, is the salt value viewable by the client? Looking at the source code, it seems to be prepending the salt value to the cookie.

Answer 1

The anti-XSRF token already contains embedded information which can uniquely identify it to a particular (user, application) pair. The 'Salt' parameter is meant to distinguish which action a particular anti-XSRF token is meant for. It isn't meant to be secret. Feel free to share it with the world. I wish we had chosen a different name for it, as the term salt is misleading. Think of it more as supplementary data. :)

We already utilize a proper cryptographic salt under the covers. For more information, see my response at runtime loading of ValidateAntiForgeryToken Salt value.

tl;dr: Don't bother with the Salt property. We're considering removing it from a future version anyway.