c# - Is ValidateAntiForgeryToken autoimplemented with POST? -

i'm reading post considered secure , no, , should implement [validateantiforgerytoken] in every action of every controller.

the question is: need use [validateantiforgerytoken] data annotation when use [post]?

it's off default.
there's reason this. not every post has come form (especially true since question tagged asp.net-core)

you should decorate controller action [validateantiforgerytoken]

[validateantiforgerytoken] public iactionresult post(model model) {     // ... etc } 

if you're using form tag helper, automatically add anti forgery token you, <form> markup.

the markup generated like:

<form action="/mycontroller" method="post">     <input name="__requestverificationtoken" type="hidden" value="fhtffhkknsdfhyazftn6c4ybzamsewg0srqluqqloi/oijoijoijojhishg" />     <!-- rest of form here --> </form> 

note: can manually enable/disable __requestverificationtoken generation using form helper tags:

<form  asp-controller="mycontroller"   asp-action="myaction"   asp-antiforgery="false"   method="post">