Automatic CSRF protection based on Fetch Metadata headers

In this post, I take a look at the new Cross-Site Request Forgery (CSRF) protection added to ASP.NET Core in .NET 11 preview 6, which relies on the Fetch Metadata HTTP headers, instead of the "traditional" anti-CSRF tokens used in earlier versions of .NET Core. If you haven't heard about the Fetch Metadata HTTP headers, I wrote a post about them last week that I'd recommend looking at first! I first talk about CSRF attacks, the existing protections in ASP.NET Core, discuss why a new approach is possible, and provide a brief recap on Fetch Metadata headers. Next I show how this works in ASP.NET Core as of .NET 11 preview 6. Finally, I take a look at the implementation behind the feature, as well as dive into why the new feature doesn't really help you if you're using MVC or Razor Pages. What is Cross-Site Request Forgery (CSRF)? Cross-Site Request Forgery is a type of attack where a malicious website forges a request to your web app, and the application handles the request as though it…