Antiforgery Tokens
Your cookie proves who you are.
It doesn’t prove you meant to do it.
Imagine you’re logged into an ASP.NET Core application.
You have a form that transfers money.
Now imagine another website quietly submits that form from your browser.
Your browser automatically sends your authentication cookie.
To your server, the request looks legitimate.
The user is authenticated.
But the user never intended the action.
That’s the problem antiforgery tokens solve.
The idea is simple
Your legitimate form gets an additional secret token.
When the form is submitted, the server validates that token before processing the request.
The malicious site can trigger the request, but it can’t obtain the legitimate token.
In .NET: AddAntiforgery
Remember this
Cookie → proves identity
Antiforgery token → proves intent
Everyday analogy
A bank teller recognizes your face.
That proves who you are.
But to withdraw money, you still need to fill out and sign the withdrawal slip.
Your face proves identity.
The signed slip proves intent.
That’s antiforgery.
