--- title: Automatic CSRF protection based on Fetch Metadata headers description: ASP.NET Core in .NET 11 preview 6 introduces a new CSRF protection mechanism based on Fetch Metadata HTTP headers (Sec-Fetch-Site, Sec-Fetch-Mode, etc.)... canonical: https://daily.dev/posts/automatic-csrf-protection-based-on-fetch-metadata-headers-4wx4vjldj twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Automatic CSRF protection based on Fetch Metadata headers | daily.dev og:description: ASP.NET Core in .NET 11 preview 6 introduces a new CSRF protection mechanism based on Fetch Metadata HTTP headers (Sec-Fetch-Site, Sec-Fetch-Mode, etc.)... og:url: https://daily.dev/posts/automatic-csrf-protection-based-on-fetch-metadata-headers-4wx4vjldj og:image: https://api.daily.dev/og/posts/4WX4vjlDJ.png og:image:alt: Automatic CSRF protection based on Fetch Metadata headers og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Automatic CSRF protection based on Fetch Metadata headers **[.NET Escapades](https://daily.dev/sources/andrewlock)** · 16 min read · 0 upvotes · 0 comments ## Summary ASP.NET Core in .NET 11 preview 6 introduces a new CSRF protection mechanism based on Fetch Metadata HTTP headers (Sec-Fetch-Site, Sec-Fetch-Mode, etc.) instead of the traditional synchronizer token pattern. The new approach avoids the operational overhead of the Data Protection system, eliminates multi-tab token invalidation issues, and reduces per-request cryptographic work. The algorithm checks whether requests are safe HTTP verbs, whether they originate from the same origin, and whether a CORS policy permits the origin before allowing or denying. The new CsrfProtectionMiddleware is added automatically to WebApplicationBuilder pipelines. Blazor SSR and minimal APIs benefit cleanly from the new approach, but MVC and Razor Pages continue to generate and validate tokens in addition, requiring significant hacking to opt out entirely. Cross-origin form posts can be permitted by configuring CORS allowed origins rather than disabling CSRF entirely. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [CSRF Protection without Tokens or Hidden Form Fields](https://daily.dev/posts/csrf-protection-without-tokens-or-hidden-form-fields-a651bvhew) · Hacker News · 0 upvotes · 0 comments - [CSRF Protection in Nette 3.4: No More Tokens Thanks to Sec-Fetch Headers – Nette Blog](https://daily.dev/posts/csrf-protection-in-nette-3-4-no-more-tokens-thanks-to-sec-fetch-headers-nette-blog-ll3elklpp) · Nette · 7 upvotes · 1 comments - [A modern approach to preventing CSRF in Go– Alex Edwards](https://daily.dev/posts/a-modern-approach-to-preventing-csrf-in-go-alex-edwards-5b32watfz) · Lobsters · 1 upvotes · 0 comments - [Understanding the Fetch Metadata HTTP headers: Sec-Fetch-Site and friends](https://daily.dev/posts/understanding-the-fetch-metadata-http-headers-sec-fetch-site-and-friends-erlzmca7a) · .NET Escapades · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#.net](https://daily.dev/tags/.net), [#aspnet](https://daily.dev/tags/aspnet) [View this post on daily.dev](https://daily.dev/posts/automatic-csrf-protection-based-on-fetch-metadata-headers-4wx4vjldj) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Automatic CSRF protection based on Fetch Metadata headers","url":"https://daily.dev/posts/automatic-csrf-protection-based-on-fetch-metadata-headers-4wx4vjldj","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/automatic-csrf-protection-based-on-fetch-metadata-headers-4wx4vjldj"},"datePublished":"2026-08-04T10:20:17.233Z","dateModified":"2026-08-04T10:21:06.791Z","description":"ASP.NET Core in .NET 11 preview 6 introduces a new CSRF protection mechanism based on Fetch Metadata HTTP headers (Sec-Fetch-Site, Sec-Fetch-Mode, etc.)...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/738d17c1c0c137a82f37a3629693fff1?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/738d17c1c0c137a82f37a3629693fff1?_a=AQAEuop","isAccessibleForFree":true,"articleSection":".NET Escapades","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":".NET Escapades","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/74ebd66cf7e840b6b29913eae3da9189","url":"https://daily.dev/sources/andrewlock"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/automatic-csrf-protection-based-on-fetch-metadata-headers-4wx4vjldj","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,.net,aspnet","timeRequired":"PT16M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":".NET Escapades","item":"https://daily.dev/sources/andrewlock"},{"@type":"ListItem","position":3,"name":"Automatic CSRF protection based on Fetch Metadata headers"}]} ```