---
title: "Preventing Cross Site Request Forgery attack in MVC"
description: "It is a method of attacking website from malicious or fake site send request to valid or vulnerable website where the user is logged In,"
author: "Sushant Mishra"
published: 2017-09-15
updated: 2019-09-07
canonical: https://www.mindstick.com/articles/12590/preventing-cross-site-request-forgery-attack-in-mvc
category: "asp.net"
tags: ["asp.net mvc", "mvc", "mvc3", "mvc4", "mvc5"]
reading_time: 2 minutes
---
# Preventing Cross Site Request Forgery attack in MVC
\
It is a method of attacking website from malicious or fake site send request to valid or vulnerable website where the user is logged In, we should know that all [web application](https://www.mindstick.com/articles/13069/progressive-web-application-pwas-all-you-need-to-know-about) platform is vulnerable from CSRF that is cross site [request forgery](https://www.mindstick.com/forum/34124/how-to-avoid-cross-site-request-forgery-csrf-in-asp-dot-net-mvc) attack it is also known as XSRF. We can prevent it from the Anti-Forgery Token.
Antiforgery token is mainly used in form post action to verify posted data. In every request the [web server](https://www.mindstick.com/articles/23199/digital-personal-server-the-premium-web-server) sends a cookie to the client browser [while posting](https://answers.mindstick.com/qa/93273/can-we-generate-any-tags-while-posting-any-article-at-mindstick) data or next request time. When user submit data .asp.net [MVC framework](https://www.mindstick.com/forum/34038/how-to-work-with-checkbox-in-asp-dot-net-mvc-framework) checks for a request forgery it also check that _Request-VerificationToken Hidden Field and _Request-verification Token.
##### Now we will take an example to understand this
Cross Site Request Forgery is an attack in which User or Victim is already login to Valid site (abc.Com) and in same way Victim open some other Malicious site in another tab then Malicious site send request to valid site (abc.Com) using logged in session of victim for attack as (abc.Com) only know that the request which is coming from valid User and it Execute the task and Victim has been attacked using Cross Site Request Forgery.
##### Adding @Html.AntiForgeryToken() to Index view
For saving from attack of cross site request forgery attack we need to add antiforgery token as shown below
```
@model CodeFirstApproch_Demo.Models.Student@{
Layout = null;}
Index
@using (Html.BeginForm("Index","Home",FormMethod.Post))
{
@Html.AntiForgeryToken()
Name @Html.TextBoxFor(x=>x.Name); Father Name @Html.TextBoxFor(x=>x.Father_Name); Email @Html.TextBoxFor(x=>x.Email); Address @Html.TextBoxFor(x=>x.Address); Date of Birth@Html.TextBoxFor(x =>
x.Dob, new {type="date"});
@ViewBag.msg
}