Answer
The Anti-Forgery system protects against CSRF attacks by issuing two related tokens:
- A cookie token stored in the browser.
- A form/request token embedded in forms or headers.
On POST (or unsafe verbs), the server validates that both tokens are present and match. If not, the request is rejected. This ensures that only requests initiated from the legitimate site using the correct user context are accepted.