csrf

ASP.NET Core Ditches CSRF Tokens for Fetch Metadata in .NET 11

.NET 11 introduces an automatic CSRF protection middleware that uses browser Fetch Metadata headers instead of tokens. It's on by default, requires no code changes, and fundamentally changes how cross-site request forgery is handled in ASP.NET Core.

CSRF Protection in ASP.NET Core: How Anti-Forgery Tokens Work

Understanding cross-site request forgery attacks and how ASP.NET Core's anti-forgery system prevents them.