---
title: "How to avoid cross site request forgery CSRF in ASP.NET MVC"  
description: "How to avoid cross site request forgery CSRF in ASP.NET MVC"  
author: "Simond Gear"  
published: 2016-05-03  
updated: 2016-05-23  
canonical: https://www.mindstick.com/forum/34124/how-to-avoid-cross-site-request-forgery-csrf-in-asp-dot-net-mvc  
category: "asp.net mvc"  
tags: ["asp.net", "asp.net mvc"]  
reading_time: 3 minutes  

---

# How to avoid cross site request forgery CSRF in ASP.NET MVC

Hi Everyone,\
I want to know how to [avoid](https://yourviews.mindstick.com/story/1518/tips-to-avoid-dengue-at-home) [cross](https://www.mindstick.com/forum/33892/how-to-handle-cross-thread-exception-in-winforms) site [request forgery](https://answers.mindstick.com/qa/112056/how-do-i-prevent-cross-site-request-forgery-csrf-attacks-in-my-web-applications) [CSRF](https://www.mindstick.com/forum/161260/what-is-the-samesite-attribute-and-how-does-it-help-prevent-csrf-attacks)(Cross Site Request Forgery) in my [MVC](https://www.mindstick.com/forum/155803/define-cache-profile-in-mvc) application.\
Thank you.

## Replies

### Reply by Santosh Kumar Singh

**Prevent MVC Application from Cross Site Request Forgery Attacks**

All web application platforms are potentially vulnerable to CSRF (Cross-Site Request Forgery) attacks. The best way to prevent this attack in MVC application is to use Anti-Forgery token.

Consider a banking website "www.bank.com" contains an action method DeleteUser in User Controller. When a web request comes from a client, the controller fetches the user id from session and deletes the user from database. Consider one hacker created a site "www.songs.com" and it contain one button 'Latest songs'. The button click event calls the "www.bank.com/User/DeleteAccount". A user is logged in "www.bank.com" and he is visiting "www.songs.com" using the same browser with another tab. When he clicking the 'Latest songs' button, his account will delete from the bank database. To avoid these type of unwanted requests from other sites, MVC application developers use **Anti-Forgery Token.**

Anti-Forgery Token is mainly used in form POST actions to verify the source of the POST data. In this method, for each page request, the web server sends a cookie to the client browser. While posting the data or next request time, the web server uses this cookie for client authentication. If the request is coming from an unauthorized site, the cookie will be null or invalid. By adding [ValidateAntiForgeryToken] above the controller and @Html.AntiForgeryToken() in the view page, we can prevent cross site requests forgery.

## Using the Code

The below code illustrates how Anti-Forgery Token Cross Site Request Forgery:

## Without Anti-Forgery Token

## 1. Controller (Controller for deleting the user account)

\

```
public class UserController : Controller   {       public ActionResult DeleteUser()       {           var userId = (int)Session["userId"];           DeleteUserFromDb(userId);  //Function for deleting the user from Database          return View();       }   }
```

## \

## 2. View (Button for deleting the user account in Bank page)

\

```
@using (Html.BeginForm("DeleteUser", "User")){        <input type="submit" value="Delete My Account" />}
```

## \

## With Anti-Forgery Token

## 1. Controller

\

```
[ValidateAntiForgeryToken] public class UserController : Controller    {        public ActionResult DeleteUser()        {            var userId = (int)Session["userId"];                        DeleteUserFromDb(userId);//Function for deleting the user from Database            return View();         }    }
```

## \

## 2. View

\

```
@using (Html.BeginForm("DeleteUser", "User")){      @Html.AntiForgeryToken()    <input type="submit" value="Delete My Account" />}
```

## \

## Cross Site Request Error

\

**Server Error in '/' Application.**

**The required anti-forgery cookie "__RequestVerificationToken" is not present.**

Description: An unhandled exception occurred during the execution of the current web request.

Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.Web.Mvc.HttpAntiForgeryException:

The required anti-forgery cookie "__RequestVerificationToken" is not present.

### Reply by Anupam Mishra

Hi Simond,\
To avoid Cross Site [Request](https://www.mindstick.com/blog/255/post-get-and-request-function-in-php) Forgery (CSRF) in ASP.NET MVC, we need to do two things for each page.\
1. Add **[ValidateAntiForgeryToken]** attribute in the Controller Action method which is executing when the form data is being submitted.\
2. Add **@Html.AntiForgeryToken()** element in the HTML form.\
\


---

Original Source: https://www.mindstick.com/forum/34124/how-to-avoid-cross-site-request-forgery-csrf-in-asp-dot-net-mvc

Copyright © MindStick Software Pvt. Ltd. This Markdown version is provided for developers, AI systems, and offline reading.