vetkit.csharp.csrf.antiforgery-disabled
Anti-forgery token validation is explicitly disabled for an MVC/Razor endpoint. If the endpoint changes state for a cookie-authenticated user, only the cookie's SameSite setting still stands between it and cross-site request forgery (CSRF).
Last updated:
Suite: Security
csharp
Anti-forgery token validation is explicitly disabled for an MVC/Razor endpoint. If the endpoint changes state for a cookie-authenticated user, only the cookie's SameSite setting still stands between it and cross-site request forgery (CSRF).
Category: SECURITY · Engine rule severity: INFO
How to fix it
Remove [IgnoreAntiforgeryToken] / .DisableAntiforgery(); for webhooks authenticate the caller with a signature instead and keep them on a separate, cookie-less route.
References
Source: packages/engine/rules/sast/csharp.yml.
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.