The [ValidateAntiForgeryToken] attribute protects state-changing MVC controller actions from cross-site request forgery (CSRF). It requires matching antiforgery tokens in the request cookie and form data, rejecting requests when either token is missing or does not match. section 29.2
Use it with MVC controllers and views as follows:
- Add [ValidateAntiForgeryToken] to every vulnerable action that changes state, such as POST or DELETE actions. section 29.2
- Keep the form antiforgery token. ASP.NET Core adds it to forms as a hidden __RequestVerificationToken field. section 29.2
- Do not rely on automatic validation for MVC controllers with views; unlike Razor Pages, they require explicit attributes. section 29.2
Protected state-changing form
A withdrawal form posts an amount to an MVC action marked with [ValidateAntiForgeryToken]. A legitimate browser request includes the cookie token and hidden form token; a forged form cannot read and reproduce the hidden token, so the request is rejected. section 29.2
