Using ASP.NET Core 6 Web API Antiforgery Token in extern consumer (App) without Authentication

I don’t agree with the answer that "it is not necessary to implement Anti-Forgery Token protection against CSRF Attacks when building an API".

There is still a risk that somehow intruder can force the client app to send a malicious request.

To configure Anti-Forgery Protection in .NET Web API (without using MVC Views), you need to use the package Microsoft.AspNetCore.Antiforgery.

Keep in mind that there are two tokens which are being validated: a Cookie Token and a Request Token (from an HTTP header).

// Field
IAntiforgery _antiforgery;

var tokens = _antiforgery.GetAndStoreTokens(HttpContext);

As a result, tokens will contain the value:

{
    "CookieToken": "CfDJ8JPuS3COPd9AmHCMBz_IFVdVzR8cfeD2or9v3qMLlWgRiN812hKbkh4o8TpYl4AdA3uJ3FeoY3eozx59q_uSnloXl80nLEd6twLzkDdn4AifcsGWcwaAxWSrGTui0vwl7-SHjftCfkbj9pAlDC_DS0Q",
    // Ignore this: built-in mechanism for forms
    "FormFieldName": "__RequestVerificationToken",
    "HeaderName": "X-XSRF-TOKEN",
    "RequestToken": "CfDJ8JPuS3COPd9AmHCMBz_IFVfnP50wBywG2WJmFoYA7nx-VGzBjPRY16-p3BBFRMUGHt4cz-M-VrZ_jX_7vUoIt0OX3xhHNw8swt0CebGa4P41cVej2F_DvvayOvrhbY6s3Z2U1aZWHmAvBT8NlH7ueRE"
}

Note that CookieToken and RequestToken are different.

Cookie Token is handled automatically. But Request Token should be handled by us.

1. Create a validation middleware:

   public class AntiforgeryMiddleware : IMiddleware
   {
       private readonly IAntiforgery _antiforgery;
   
       public AntiforgeryMiddleware(IAntiforgery antiforgery)
       {
           _antiforgery = antiforgery;
       }
   
       public async Task InvokeAsync(HttpContext context, RequestDelegate next)
       {
           var isGetRequest = string.Equals("GET", context.Request.Method, StringComparison.OrdinalIgnoreCase);
           if (!isGetRequest)
           {
               await _antiforgery.ValidateRequestAsync(context);
           }
   
           await next(context);
       }
   }
   

2. Configure DI in your Web API application:

   // Startup.cs
   public void ConfigureServices(IServiceCollection services)
   {
       // ...
   
       // Extension method comes from the `Microsoft.AspNetCore.Antiforgery` package
       services.AddAntiforgery(options =>
       {
           options.HeaderName = "X-XSRF-TOKEN";
       });
   
       services.AddScoped<AntiforgeryMiddleware>();
   }
   

3. Configure a validation middleware:

   // Startup.cs
   public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
   {
       // ...
   
       app.UseMiddleware<AntiforgeryMiddleware>();
   
       app.UseEndpoints(endpoints =>
       {
           endpoints.MapControllers();
       });
   }
   

4. Create a XSRF Token endpoint:

   [Route("api/xsrf-token")]
   [ApiController]
   public class AntiForgeryController : Controller
   {
       private IAntiforgery _antiforgery;
   
       public AntiForgeryController(IAntiforgery antiforgery)
       {
           _antiforgery = antiforgery;
       }
   
       [IgnoreAntiforgeryToken]
       public IActionResult Get()
       {
           // Creates and sets the cookie token in a cookie
           // Cookie name will be like ".AspNetCore.Antiforgery.pG4SaGh5yDI"
           var tokens = _antiforgery.GetAndStoreTokens(HttpContext);
   
           // Take request token (which is different from a cookie token)
           var headerToken = tokens.RequestToken;
           // Set another cookie for a request token
           Response.Cookies.Append("XSRF-TOKEN", headerToken, new CookieOptions
           {
               HttpOnly = false
           });
           return NoContent();
       }
   }
   

5. On the client make a request to the URL /api/xsrf-token.

   Then read a request token cookie XSRF-TOKEN and set it to a X-XSRF-TOKEN HTTP header for non-GET requests:

   X-XSRF-TOKEN: <request-token>