Anti-forgery token is ignored via IgnoreAntiforgeryTokenAttribute CS-A1011
Security
Critical
a01
cwe-352
sans top 25
owasp top 10
Antiforgery token is used in validation and establishing identity to an extent before serving the required data or resource. This potentially helps prevent security issues. The IgnoreAntiforgeryTokenAttribute, however, skips this token's validation. It is recommended that you not use this token to skip the validation.
Bad Practice
[HttpPost, IgnoreAntiforgeryToken]
public IActionResult PostResults(Model m)
{
// ...
}
Recommended
[HttpPost]
public IActionResult PostResults(Model m)
{
// ...
}