What is CSRF and how do you prevent it in ASP.NET?

Question

ICSM · Answer

CSRF (Cross-Site Request Forgery) is a type of attack where a malicious website tricks a user's browser into making an unwanted request to a different site where the user is authenticated (like submitting a form or triggering an action without consent).
Example of a CSRF Attack
Imagine a user is logged in to bank.com, and visits a malicious site that silently submits:
andlt;form action="https://bank.com/transfer" method="POST"andgt;
  andlt;input type="hidden" name="amount" value="10000" /andgt;
  andlt;input type="hidden" name="to" value="attacker-account" /andgt;
andlt;/formandgt;
andlt;scriptandgt;document.forms[0].submit();andlt;/scriptandgt;
If the site doesn't verify the request origin, the bank may wrongly honor the request.
How to Prevent CSRF in ASP.NET (MVC or Core)
1. Use Anti-Forgery Tokens
ASP.NET MVC and Core provide built-in anti-forgery token mechanisms.
In Razor Views:
andlt;form asp-action="TransferMoney" method="post"andgt;
    @Html.AntiForgeryToken()
    andlt;!-- form fields --andgt;
andlt;/formandgt;
In Controller:
[HttpPost]
[ValidateAntiForgeryToken]
public IActionResult TransferMoney(MyModel model)
{
    // Safe from CSRF
}
The @Html.AntiForgeryToken() generates a hidden field with a token, and the
[ValidateAntiForgeryToken] attribute validates it.
2. For Web APIs
For APIs (which don’t use cookies by default), CSRF is less common unless using cookie-based auth. If so:
Require clients to send an anti-CSRF token via a custom header (e.g. X-CSRF-TOKEN)
Validate it manually or using middleware
3. Use SameSite Cookie Attribute
In .NET Core, set your auth cookie to:
options.Cookie.SameSite = SameSiteMode.Strict;
This prevents browsers from sending cookies on cross-site requests.
4. Disable Cross-Origin for Unsafe Methods
Only allow safe GET requests from cross-origin sources.Block POST, PUT, DELETE, etc. using CORS unless you
explicitly trust the source.
Summary
Technique
Applies To
Purpose
@Html.AntiForgeryToken()
MVC Views
Embed anti-CSRF token in form
[ValidateAntiForgeryToken]
Controller Action
Validate token presence/validity
SameSite=Strict
Cookies
Prevent cross-origin cookie send
CORS Restrictions
Web APIs
Block untrusted origins
Custom Header Tokens
Web APIs
Manually validate via header

forum

What is CSRF and how do you prevent it in ASP.NET?

ICSM

Can you answer this question?

1 Answers

Example of a CSRF Attack

How to Prevent CSRF in ASP.NET (MVC or Core)

1. Use Anti-Forgery Tokens

In Razor Views:

In Controller:

2. For Web APIs

3. Use `SameSite` Cookie Attribute

4. Disable Cross-Origin for Unsafe Methods

Summary

Liked By

Technique	Applies To	Purpose
`@Html.AntiForgeryToken()`	MVC Views	Embed anti-CSRF token in form
`[ValidateAntiForgeryToken]`	Controller Action	Validate token presence/validity
`SameSite=Strict`	Cookies	Prevent cross-origin cookie send
CORS Restrictions	Web APIs	Block untrusted origins
Custom Header Tokens	Web APIs	Manually validate via header