Disabled CSRF protection (ARCH322)

Key dotnet.security.disabled-csrf · Severity error · Category security · CWE CWE-352

Using [IgnoreAntiforgeryToken] on a state-changing endpoint removes antiforgery (CSRF) protection. This lets attackers trigger unwanted requests using a victim’s authenticated session.

Incorrect

[HttpPost]
[IgnoreAntiforgeryToken]
public IActionResult TransferFunds(TransferModel model)
{
    _bank.Transfer(model);
    return RedirectToAction("Index");
}

Correct

[HttpPost]
[ValidateAntiForgeryToken]
public IActionResult TransferFunds(TransferModel model)
{
    _bank.Transfer(model);
    return RedirectToAction("Index");
}

Fix

Remove [IgnoreAntiforgeryToken] and apply [ValidateAntiForgeryToken] to all state-changing POST/PUT/DELETE actions.