Skip to content

Remove redundant app.UseAntiforgery() from Blazor Web templates#563

Closed
DeagleGross wants to merge 1 commit into
dmkorolev/csrf-in-blazorfrom
deaglegross/remove-useantiforgery-from-templates
Closed

Remove redundant app.UseAntiforgery() from Blazor Web templates#563
DeagleGross wants to merge 1 commit into
dmkorolev/csrf-in-blazorfrom
deaglegross/remove-useantiforgery-from-templates

Conversation

@DeagleGross

Copy link
Copy Markdown
Owner

Removes the explicit app.UseAntiforgery(); call from the two Program.cs variants of the BlazorWeb-CSharp template. The call is now redundant in Blazor apps for two reasons:

  1. CsrfProtectionMiddleware (auto-injected by WebApplication.CreateBuilder since Implement Cross-Site Request Forgery Algorithm based on Fetch Metadata headers dotnet/aspnetcore#66585) blocks cross-site state-changing requests via Sec-Fetch-Site / Origin headers — covering the protection that UseAntiforgery() was previously providing for Blazor form posts in the template.
  2. The Razor Components endpoint invoker no longer self-validates token-based antiforgery when the new CSRF middleware ran (companion change in this stack — base branch dmkorolev/csrf-in-blazor, PR [breaking] Defer antiforgery/CSRF rejection to form consumers via IAntiforgeryValidationFeature dotnet/aspnetcore#67082). The token-generation side is also gated on the legacy AF middleware actually running, so omitting UseAntiforgery() is internally consistent.

Files changed

File Variant
src/ProjectTemplates/Web.ProjectTemplates/content/BlazorWeb-CSharp/BlazorWebCSharp.1/Program.cs Top-level statements
src/ProjectTemplates/Web.ProjectTemplates/content/BlazorWeb-CSharp/BlazorWebCSharp.1/Program.Main.cs Main-style

Each file: 2 deletions (the app.UseAntiforgery(); line plus the now-orphan blank line below it).

Scope notes

A full-tree grep "UseAntiforgery" confirmed these are the only templates that call the method. No MVC, Razor Pages, Web API, or other Web templates touch antiforgery. Test assets and framework source intentionally left alone. In-tree samples (src/Components/Samples/BlazorUnitedApp/Program.cs, src/Identity/samples/IdentitySample.PasskeyUI/Program.cs) were initially included but reverted — the equivalent cleanup for sample apps belongs in dotnet/AspNetCore.Docs.Samples, not here.

grep "Antiforgery" src/ProjectTemplates/test/ returns zero matches, so no snapshot/baseline test needs updating.

Verification

  • dotnet build src/ProjectTemplates/Web.ProjectTemplates/Microsoft.DotNet.Web.ProjectTemplates.csproj → 0 errors / 0 warnings.
  • Re-grep across src/ProjectTemplates confirms no UseAntiforgery references remain in template content.

Companion PRs

Stacked PR; merge after PR dotnet#67082.

Both Program.cs (top-level) and Program.Main.cs variants of the BlazorWeb-CSharp template no longer need the explicit call: CsrfProtectionMiddleware (auto-injected by WebApplication) handles cross-site request protection via Sec-Fetch-Site/Origin, and the Razor Components endpoint invoker no longer self-validates token-based antiforgery when the new CSRF middleware ran.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant