Andrew Lock • 8/4/2026

Automatic CSRF protection based on Fetch Metadata headers

Read Original

This article discusses the new CSRF protection feature in ASP.NET Core .NET 11 preview 6, which uses Fetch Metadata HTTP headers instead of traditional anti-CSRF tokens. It explains CSRF attacks, existing protections, and why the new approach is viable. The author demonstrates how to use the feature, examines its implementation, and notes limitations for MVC or Razor Pages. Aimed at developers interested in web security and ASP.NET Core updates.

0 comments
#Csrf #Aspnet Core #Dotnet
Automatic CSRF protection based on Fetch Metadata headers

Comments

No comments yet

Be the first to share your thoughts!

Browser Extension

Get instant access to AllDevBlogs from your browser

Top of the Week

1
Limit token usage in Microsoft Agent Framework
Jesse Liberty • 1 votes
2
How to Roll Back AI Agents: Incident Response, Circuit Breakers, and Recovery Patterns
Paul Bryant • 1 votes
3
Avoiding Reasoning Model Failures with Microsoft Foundry
Luke Murray • 1 votes
4
When Your AI Agent Lies: Silent LLM Fallbacks
Luke Murray • 1 votes
5
Adding a custom MCP server to Claude and ChatGPT
Simon Willison • 1 votes
6
Testing AI prompts and comparing models with promptfoo
Tim Deschryver • 1 votes
7
Superlogical
Mitchell Hashimoto • 1 votes