Document antiforgery HTTP method limitations and HttpMethodOverride interaction - #66772
#66772Document antiforgery HTTP method limitations and HttpMethodOverride interaction#66772cincuranet merged 3 commits intodotnet:maindotnet/aspnetcore:mainfrom GrantTotinov:issue-66687-docsGrantTotinov/aspnetcore:issue-66687-docsCopy head branch name to clipboard
Conversation
There was a problem hiding this comment.
Pull request overview
This PR updates public API documentation to clarify antiforgery validation’s HTTP method scope and the security implications when combined with HttpMethodOverrideMiddleware (form-field mode), addressing scenarios where an overridden method like DELETE can bypass antiforgery middleware validation.
Changes:
- Document that antiforgery middleware (
UseAntiforgery/AntiforgeryMiddleware) only validates tokens forPOST,PUT, andPATCH. - Add guidance for validating other HTTP methods by explicitly calling
IAntiforgery.ValidateRequestAsync/IsRequestValidAsync. - Document the interaction between form-field HTTP method override and antiforgery validation.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| src/Middleware/HttpOverrides/src/HttpMethodOverrideExtensions.cs | Adds remarks warning about form-field method override rewriting the request method before later middleware, and notes antiforgery method limitations. |
| src/Antiforgery/src/RequireAntiforgeryTokenAttribute.cs | Adds remarks clarifying that UseAntiforgery validation is limited to POST/PUT/`PATCH and how to validate other methods manually. |
| src/Antiforgery/src/AntiforgeryApplicationBuilderExtensions.cs | Adds remarks describing antiforgery method limitations, manual validation options, and the method-override interaction. |
d1f4827 to
6535052
Compare
|
@DeagleGross Based on your #66687 (comment) do you want to add something here? |
|
I am fine with the changes here, I think we should change public docs and describe it there as well before closing the related issue: https://learn.microsoft.com/en-us/aspnet/core/security/anti-request-forgery?view=aspnetcore-10.0#antiforgery-with-minimal-apis |
|
@GrantTotinov Will you also open PR for https://github.com/dotnet/aspnetcore.docs or should I do it? |
|
@cincuranet Of course, I will open a PR as soon as possible. |
|
I'm going to merge this and keep an eye on the docs PR. Thanks @GrantTotinov. |
|
/ba-g Failures are unrelated. |
|
Awesome, thank you! Let me know if anything else is needed. @cincuranet |
Document antiforgery HTTP method limitations and HttpMethodOverride interaction
Description
Documents that AntiforgeryMiddleware and UseAntiforgery() only validate HTTP POST, PUT, and PATCH requests. Adds guidance for developers who need validation for other HTTP methods (for example, DELETE) to resolve IAntiforgery from DI and call ValidateRequestAsync or IsRequestValidAsync explicitly.
Also documents the interaction with HttpMethodOverrideMiddleware when configured with FormFieldName, where a POST request can be overridden to DELETE and bypass antiforgery validation.
Fixes #66687