Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The tutorials I've read tell you to use [ValidateAntiForgeryToken] attributes and <%= Html.AntiForgeryToken() %> in your code.

I was wondering why this isn't a built-in automatic setting or at least a global toggle in the web.config. Perhaps it is, and I haven't realised, but I am doing it by hand and I can't help but wonder if there is a good reason for not handling it automatically behind the scenes. Any ideas?

share|improve this question
How do you want to automatically handle it for AJAX requests? – Florian Margaine Jun 14 '13 at 10:01
I don't think it'd apply to AJAX requests, but if you're applying it to all incoming requests it won't matter if it is unable to add the request key to the AJAX because you'll simply get an anti forgery exception, which is safe because you'll realise you need to include it when you're testing, rather than the opposite which is things get through without you realising. Although you could leave AJAX entirely up to the user to consider. At the moment I'm just adding [ValidateAntiForgeryToken] attributes to every single post method and wondering why. – SLC Jun 14 '13 at 10:04
Then another reason might be that CSRF protection is kind of useless for anonymous users. – Florian Margaine Jun 14 '13 at 10:06
It's a good question but impossible to answer without talking to someone from Microsoft. – LachlanB Jun 14 '13 at 12:32
up vote 1 down vote accepted

I think in most cases it doesn't really matter if a form was issued by your server or not.

Anti-forgery tokens require session state on the server. When a user session expires so will the forms they have open, they become unpostable. Can be pretty annoying.

share|improve this answer
Unless that form was posted from a malicious site to do something like delete your account, withdraw funds, etc depending on what sites you are logged into. You should look more into cross site request forgeries and related attacks – schmidty Nov 7 '13 at 22:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.