Html.AntiForgeryToken() still required?

Question

Is @Html.AntiForgeryToken() still required in ASP.NET .NET4.6 vNext?

The form decorations have changed to

<form asp-controller="Account"        asp-action="Login"        asp-route-returnurl="@ViewBag.ReturnUrl"        method="post"        class="form-horizontal"        role="form"> 

From this

@using (Html.BeginForm("Login",                         "Account",                         new { ReturnUrl = ViewBag.ReturnUrl },                         FormMethod.Post,                         new { @class = "", role = "form" })) 

And no longer include this

@Html.AntiForgeryToken() 

The Controller Actions are still marked with the ValidateAntiForgeryToken attribute as expected though so where exactly is it coming from? Automagically?

[HttpPost] [AllowAnonymous] [ValidateAntiForgeryToken] public async Task<IActionResult> Login(LoginViewModel model, string returnUrl = null) 

Answer 1

The form tag helper will automatically add the anti forgery token. (Unless you use it as a standard html form element, manually adding an action attribute). Check the source code of the form tag helper, you will see the following at the end of the Process method.

if (Antiforgery ?? antiforgeryDefault) {     var antiforgeryTag = Generator.GenerateAntiforgery(ViewContext);     if (antiforgeryTag != null)     {         output.PostContent.AppendHtml(antiforgeryTag);     } } 

If you check the html of the login page, you will see the following hidden input inside the form:

<input name="__RequestVerificationToken" type="hidden" value="CfDJ8BIeHClDdT9..."> 

You can also manually enable/disable it adding the asp-antiforgery attribute:

<form asp-controller="Account" asp-action="Register" asp-antiforgery="false" method="post" class="form-horizontal" role="form">