ASP.NET Core in .NET 11 preview 6 introduces a new CSRF protection mechanism based on Fetch Metadata HTTP headers (Sec-Fetch-Site, Sec-Fetch-Mode, etc.) instead of the traditional synchronizer token pattern. The new approach avoids the operational overhead of the Data Protection system, eliminates multi-tab token invalidation issues, and reduces per-request cryptographic work. The algorithm checks whether requests are safe HTTP verbs, whether they originate from the same origin, and whether a CORS policy permits the origin before allowing or denying. The new CsrfProtectionMiddleware is added automatically to WebApplicationBuilder pipelines. Blazor SSR and minimal APIs benefit cleanly from the new approach, but MVC and Razor Pages continue to generate and validate tokens in addition, requiring significant hacking to opt out entirely. Cross-origin form posts can be permitted by configuring CORS allowed origins rather than disabling CSRF entirely.
