AutoValidateAntiForgeryToken vs. ValidateAntiForgeryToken

Question

I was trying to secure a post method against side scripting just now through providing an anti forgery token but noticed, in .Net Core there is another attribute named as AutoAntiForgeryToken. The XML comments, and the online search did not provide much info on this new attribute.

Any help and description of what the new attribute is, will be much appreciated.

Answer 1

From AutoValidateAntiforgeryTokenAttribute documentation:

An attribute that causes validation of antiforgery tokens for all unsafe HTTP methods. An antiforgery token is required for HTTP methods other than GET, HEAD, OPTIONS, and TRACE. It can be applied at as a global filter to trigger validation of antiforgery tokens by default for an application.

AutoValidateAntiforgeryTokenAttribute allows to apply Anti-forgery token validation globally to all unsafe methods e.g. POST, PUT, PATCH and DELETE. Thus you don't need to add [ValidateAntiForgeryToken] attribute to each and every action that requires it.

To use it add the following code to your ConfigureServices method of Startup class

services.AddMvc(options => {     options.Filters.Add(new AutoValidateAntiforgeryTokenAttribute()); }); 

If you need to ignore Anti forgery validation you can add [IgnoreAntiforgeryToken] attribute to the action.