AntiForgeryToken() is there in asp.net core

Hi Tridip,

@Html.AntiForgeryToken() is present in the ASP.NET Core. It is present under namespace System.Web.Mvc.

Here we need to understand

Html.AntiForgeryToken(). So it does two things First, it causes a hidden input to be created in the form, like this:

 

 

Second, it causes a cookie also called __RequestVerificationToken to be created with the same value.

 

Now ASP.NET Core includes three filters for working with antiforgery tokens: ValidateAntiForgeryToken, AutoValidateAntiforgeryToken, and IgnoreAntiforgeryToken.

Now when page goes to server, ValidateAntiForgeryToken will ensure whether cookie and hidden form are same or not if they are mismatched or if any one of them are missing server will imediately get to know that request is not valid and throws an exception.

Author is not used the Html.antiforgeryToken() rather he manually created hidden field. That is the only difference.

Hope you get it.

Thanks.