Answer
Anti-forgery protection defends against Cross-Site Request Forgery (CSRF) attacks.
ASP.NET Core generates a pair of correlated tokens: one stored in a cookie and one embedded in the form. On POST, both must be present and valid. This ensures that state-changing requests originate from the legitimate site and user, not from a malicious third-party page.