Add AddAntiforgery to minimal APIs

[Rick-Anderson]

See:

• Source for this document middleware include file
• Blog Antiforgery middleware
• PR Add support for anti-forgery middleware

---

Document Details

⚠ Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.

• ID: 8e126168-04ac-f820-baad-c336729e4da5
• Version Independent ID: 8e126168-04ac-f820-baad-c336729e4da5
• Content: Middleware with Minimal API applications
• Content Source: aspnetcore/fundamentals/minimal-apis/middleware.md
• Product: aspnet-core
• Technology: aspnetcore-fundamentals
• GitHub Login: @BrennanConroy
• Microsoft Alias: brecon

---

Associated WorkItem - 145864

[Rick-Anderson]

@martincostello @Kahbazi can you explain the following?

• CORS is an HTTP-header based mechanism, it doesn't use tokens. Why are tokens used here? EDIT see my update below.
• See Middleware in Minimal API apps

app.UseCors();
app.UseAuthentication();
app.UseAuthorization();

Is that replaced by:

var builder = WebApplication.CreateBuilder();

builder.Services.AddAntiforgery();

var app = builder.Build();

// Implicitly added by WebApplicationBuilder
// app.UseAntiforgery();

app.Run();

The HTTP method associated with the endpoint is a relevant HTTP method (not TRACE, OPTIONS, HEAD, GET).

Should be:

The HTTP method associated with the endpoint is HTTP POST.

[Rick-Anderson]

The exception explains the token
AntiforgeryValidationException: The required antiforgery request token was not provided in either form field "__RequestVerificationToken" or header value "RequestVerificationToken".

So builder.Services.AddAntiforgery() provides a token mechanism for CORS. This still needs more explaining.

[guardrex]

@Rick-Anderson @tdykstra @wadepickett ... I'm working on the Blazor forms/antiforgery bits now, and I hope to have it wrapped up by EOD Tuesday. I'm working with the Antiforgery topic in the main doc set Security node for some of it. I recommend holding off on any general antiforgery/forms work that would touch that topic until I get my PR merged.

#30035