---
title: "What is CSRF and how do you prevent it in ASP.NET?"  
description: "What is CSRF and how do you prevent it in ASP.NET?"  
author: "ICSM Computer"  
published: 2025-06-16  
updated: 2025-06-17  
canonical: https://www.mindstick.com/forum/161722/what-is-csrf-and-how-do-you-prevent-it-in-asp-dot-net  
category: "c#"  
tags: ["c#"]  
reading_time: 2 minutes  

---

# What is CSRF and how do you prevent it in ASP.NET?

**What is [CSRF](https://www.mindstick.com/forum/34124/how-to-avoid-cross-site-request-forgery-csrf-in-asp-dot-net-mvc) and how do you prevent it in [ASP.NET](https://www.mindstick.com/articles/934/default-folders-available-inside-the-asp-dot-net-application-folder)?**

## Replies

### Reply by ICSM Computer

> **CSRF (Cross-Site Request Forgery)** is a type of attack where a malicious website tricks a user's browser into making an unwanted request to a different site where the user is authenticated (like submitting a form or triggering an action without consent).

### Example of a CSRF Attack

Imagine a user is logged in to `bank.com`, and visits a malicious site that silently submits:

```html
<form action="https://bank.com/transfer" method="POST">
  <input type="hidden" name="amount" value="10000" />
  <input type="hidden" name="to" value="attacker-account" />
</form>
<script>document.forms[0].submit();</script>
```

If the site doesn't verify the request origin, the bank may wrongly honor the request.

## How to Prevent CSRF in ASP.NET (MVC or Core)

### 1. Use Anti-Forgery Tokens

ASP.NET MVC and Core provide built-in anti-forgery token mechanisms.

#### In Razor Views:

```cs
<form asp-action="TransferMoney" method="post">
    @Html.AntiForgeryToken()
    <!-- form fields -->
</form>
```

#### In Controller:

```cs
[HttpPost]
[ValidateAntiForgeryToken]
public IActionResult TransferMoney(MyModel model)
{
    // Safe from CSRF
}
```

> The `@Html.AntiForgeryToken()` generates a hidden field with a token, and the `[ValidateAntiForgeryToken]` attribute validates it.

### 2. For Web APIs

For APIs (which don’t use cookies by default), CSRF is less common unless using cookie-based auth. If so:

Require clients to send an anti-CSRF token via a custom header (e.g. `X-CSRF-TOKEN`)

Validate it manually or using middleware

### 3. Use `SameSite` Cookie Attribute

In `.NET Core`, set your auth cookie to:

```plaintext
options.Cookie.SameSite = SameSiteMode.Strict;
```

This prevents browsers from sending cookies on cross-site requests.

### 4. Disable Cross-Origin for Unsafe Methods

- Only allow safe `GET` requests from cross-origin sources.
- Block `POST`, `PUT`, `DELETE`, etc. using CORS unless you **explicitly** trust the source.

## Summary

| Technique | Applies To | Purpose |
| --- | --- | --- |
| `@Html.AntiForgeryToken()` | MVC Views | Embed anti-CSRF token in form |
| `[ValidateAntiForgeryToken]` | Controller Action | Validate token presence/validity |
| `SameSite=Strict` | Cookies | Prevent cross-origin cookie send |
| CORS Restrictions | Web APIs | Block untrusted origins |
| Custom Header Tokens | Web APIs | Manually validate via header |


---

Original Source: https://www.mindstick.com/forum/161722/what-is-csrf-and-how-do-you-prevent-it-in-asp-dot-net

Copyright © MindStick Software Pvt. Ltd. This Markdown version is provided for developers, AI systems, and offline reading.