---
title: "What is the purpose of the AntiForgeryToken in ASP.NET MVC?"  
description: "What is the purpose of the AntiForgeryToken in ASP.NET MVC?"  
author: "Revati S Misra"  
published: 2023-04-18  
updated: 2023-06-04  
canonical: https://www.mindstick.com/forum/157894/what-is-the-purpose-of-the-antiforgerytoken-in-asp-dot-net-mvc  
category: "asp.net mvc"  
tags: ["asp.net mvc", "mvc"]  
reading_time: 2 minutes  

---

# What is the purpose of the AntiForgeryToken in ASP.NET MVC?

What is the [purpose](https://yourviews.mindstick.com/view/247/no-fail-policy-failing-its-purpose) of the AntiForgeryToken in [ASP.NET MVC](https://www.mindstick.com/forum/155798/what-is-caching-in-asp-dot-net-mvc)?

## Replies

### Reply by Aryan Kumar

The AntiForgeryToken in [ASP.NET](https://www.mindstick.com/articles/934/default-folders-available-inside-the-asp-dot-net-application-folder) [MVC](https://www.mindstick.com/forum/155803/define-cache-profile-in-mvc) is a security feature that helps to prevent Cross-Site Request Forgery (CSRF) attacks. CSRF attacks are a type of attack where an attacker tricks a user into submitting a malicious request to a website without the user's knowledge or consent.

The AntiForgeryToken works by generating a unique token that is associated with each user session. This token is then included in all forms that are submitted to the server. When the server receives a form submission, it checks to see if the AntiForgeryToken is present and valid. If the token is not present or invalid, the request is rejected.

The AntiForgeryToken can be generated using the following code:

Code snippet

```plaintext
@Html.AntiForgeryToken()
```

This code will generate a unique AntiForgeryToken and render it as a hidden input field in the form.

To use the AntiForgeryToken in your controller action, you can use the ValidateAntiForgeryToken attribute. For example, the following code shows how to use the ValidateAntiForgeryToken attribute to protect a controller action from CSRF attacks:

Code snippet

```plaintext
[HttpPost]
[ValidateAntiForgeryToken]
public ActionResult Index()
{
    // ...
}
```

If the user is not logged in, the AntiForgeryToken will not be generated and the request will be rejected. If the user is logged in, the AntiForgeryToken will be generated and the request will be processed.

By using the AntiForgeryToken, you can help to protect your ASP.NET MVC application from CSRF attacks.

Here are some additional tips for preventing CSRF attacks:

- Use a strong password and do not reuse passwords across different websites.
- Be careful about what links you click on in emails and on social media.
- Install a security plugin for your browser that can help to block malicious requests.
- Keep your software up to date, including your operating system, browser, and plugins.

By following these tips, you can help to protect yourself from CSRF attacks.


---

Original Source: https://www.mindstick.com/forum/157894/what-is-the-purpose-of-the-antiforgerytoken-in-asp-dot-net-mvc

Copyright © MindStick Software Pvt. Ltd. This Markdown version is provided for developers, AI systems, and offline reading.