CSRF (or XSRF) attacks are one of the most common hacks by which a user is tricked into performing some action in one of the sites to which they are logged in. For example, imagine you have just visited your e-banking site and then you go to a malicious site, without having logged out; some JavaScript on the malicious site could have the browser post to the e-banking site an instruction to transfer some amount of money to another account. Realizing that this is a serious problem, Microsoft has long supported an anti-forgery package, Microsoft.AspNetCore.Antiforgery, which implements a mixture of the Double Submit Cookie and Encrypted Token pattern described in the Open Web Application Security Project (OWASP) cheat sheet: https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet#CSRF_Specific_Defense
OWASP aims to provide a not-for-profit repository of best practices related to security on the web. It lists common...
