Answer
CSRF protection uses synchronized cookie + request tokens. Both must match for valid POST. ASP.NET Core auto-validates and secures tokens.
Quick Answer
The antiforgery system generates two tokens: a server-signed token embedded in the form (hidden field) and a cookie. Both are tied to the current user session. On POST, ASP.NET Core reads both, verifies they match the user's session, and validates the HMAC signature. A cross-site attacker can't forge a matching pair without access to the user's cookies and the signing key.
S
SugharaIQ Editorial Team
Verified Answer
This answer has been peer-reviewed by industry experts holding senior engineering roles to ensure technical accuracy and relevance for modern interview standards.
Want to bookmark, take notes, or join discussions?
Sign in to access all features and personalize your learning experience.
Source: SugharaIQ