ASP.NET Core MVC Interview Question #116

What is Cross-Site Request Forgery (CSRF)?

Authentication, Authorization, Security & State Management Mid-Level Intermediate

Quick Interview Answer

CSRF occurs when a malicious site causes a user's browser to submit an unwanted state-changing request to another site where the user is already authenticated. Cookie authentication is particularly relevant because browsers can automatically attach authentication cookies.

Detailed Explanation

ASP.NET Core MVC anti-forgery tokens help prove that a state-changing form submission originated from the expected application context. State changes should not be implemented with GET requests.

Code Example

[HttpPost]
[ValidateAntiForgeryToken]
public IActionResult ChangeEmail(
    ChangeEmailViewModel model)
{
    // Validate and update.
    return RedirectToAction(nameof(Profile));
}