--- title: Unit testing for ValidateAntiForgeryToken and clever... description: A walkthrough shows how to write an xUnit.net unit test that uses reflection to find ASP.NET MVC Core action methods missing the [ValidateAntiForgeryToken]... canonical: https://daily.dev/posts/unit-testing-for-validateantiforgerytoken-and-clever-navigation-in-the-resharper-rider-test-runner-dwrsoogdd twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Unit testing for ValidateAntiForgeryToken and clever navigation in the ReSharper/Rider test runner | daily.dev og:description: A walkthrough shows how to write an xUnit.net unit test that uses reflection to find ASP.NET MVC Core action methods missing the [ValidateAntiForgeryToken]... og:url: https://daily.dev/posts/unit-testing-for-validateantiforgerytoken-and-clever-navigation-in-the-resharper-rider-test-runner-dwrsoogdd og:image: https://api.daily.dev/og/posts/DwRSoogdD.png og:image:alt: Unit testing for ValidateAntiForgeryToken and clever navigation in the ReSharper/Rider test runner og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Unit testing for ValidateAntiForgeryToken and clever navigation in the ReSharper/Rider test runner **[Maarten Balliauw](https://daily.dev/sources/maartenballiauw)** · 8 min read · 0 upvotes · 0 comments ## Summary A walkthrough shows how to write an xUnit.net unit test that uses reflection to find ASP.NET MVC Core action methods missing the [ValidateAntiForgeryToken] attribute, protecting against CSRF vulnerabilities in an inherited codebase. The reflection query locates public, non-GET/HEAD action methods on Controller-derived types, then feeds them into a parameterized theory test that asserts the attribute is present. A bonus trick throws a custom exception with a crafted fake stack trace so ReSharper's or Rider's test runner lets developers Ctrl+Click directly from a failing test to the offending action method. The piece closes by noting Dominick Baier's suggestion to use [AutoValidateAntiforgeryTokenAttribute] as a global filter instead, though the author prefers being explicit. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can I write a unit test to find ASP.NET MVC Core action methods missing the ValidateAntiForgeryToken attribute? Use reflection to enumerate all public, non-compiler-generated methods on types that extend Controller, filter out methods that only accept GET or HEAD, then feed the results into an xUnit.net [Theory] with [MemberData] that asserts each method has the ValidateAntiForgeryTokenAttribute via GetCustomAttributes(). Methods with no explicit HTTP verb attribute are treated as accepting all verbs and therefore get flagged too. _daily.dev surfaces practical testing patterns like this for developers hardening legacy ASP.NET MVC codebases against CSRF._ ### How do I make ReSharper or Rider's test runner navigate directly to the failing action method instead of just the test method? Throw a custom exception extending XunitException with a stack trace string formatted as "at {controller}.{actionMethod.Name}() in {actionMethod.DeclaringType.Name}:line 0" passed as the second base constructor argument. ReSharper and Rider parse that fake stack trace line and offer Ctrl+Click navigation straight to the referenced class and method, even though the line number is arbitrary. _daily.dev collects tool-level productivity tricks like this for engineers debugging failing test suites in Rider or ReSharper._ ### Should I use AutoValidateAntiforgeryTokenAttribute or explicit ValidateAntiForgeryToken attributes for CSRF protection in ASP.NET Core? Both approaches work: AutoValidateAntiforgeryTokenAttribute can be applied as a global filter to validate anti-forgery tokens by default for all HTTP methods except GET, HEAD, OPTIONS, and TRACE, with IgnoreAntiforgeryTokenAttribute for exceptions. An explicit per-action [ValidateAntiForgeryToken] attribute approach, enforced via a unit test, is preferred by some developers for clarity about which HTTP methods and CSRF protections each action supports. _daily.dev helps developers weighing global filters versus explicit attributes decide on the right CSRF strategy._ ## Similar posts on daily.dev - [The silent filter: How an ASP.NET MVC quirk became a security leak](https://daily.dev/posts/the-silent-filter-how-an-asp-net-mvc-quirk-became-a-security-leak-wec0w8625) · The Art of Simplicity · 2 upvotes · 0 comments - [Security Tests That Prove Themselves — Daily DevOps & .NET](https://daily.dev/posts/security-tests-that-prove-themselves-daily-devops-net-4mutnqllj) · We Are .NET · 1 upvotes · 0 comments - [Multiple Get Methods with the Action Method Selector Attribute in .NET Core 10](https://daily.dev/posts/multiple-get-methods-with-the-action-method-selector-attribute-in-net-core-10-ikh16xrsi) · No Dogma Blog \(Bryan Hogan\) · 0 upvotes · 0 comments --- Tags: [#aspnet](https://daily.dev/tags/aspnet), [#devtools](https://daily.dev/tags/devtools), [#security](https://daily.dev/tags/security), [#testing](https://daily.dev/tags/testing) [View this post on daily.dev](https://daily.dev/posts/unit-testing-for-validateantiforgerytoken-and-clever-navigation-in-the-resharper-rider-test-runner-dwrsoogdd) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Unit testing for ValidateAntiForgeryToken and clever navigation in the ReSharper/Rider test runner","url":"https://daily.dev/posts/unit-testing-for-validateantiforgerytoken-and-clever-navigation-in-the-resharper-rider-test-runner-dwrsoogdd","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/unit-testing-for-validateantiforgerytoken-and-clever-navigation-in-the-resharper-rider-test-runner-dwrsoogdd"},"datePublished":"2026-10-04T13:04:08.695Z","dateModified":"2026-10-15T02:22:32.852Z","description":"A walkthrough shows how to write an xUnit.net unit test that uses reflection to find ASP.NET MVC Core action methods missing the [ValidateAntiForgeryToken]...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/923ff49ea01255fc304022f2c71cf29a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/923ff49ea01255fc304022f2c71cf29a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Maarten Balliauw","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Maarten Balliauw","logo":"https://media.daily.dev/image/upload/s--rOTg3VYO--/f_auto,q_auto/v1791119043/logos/maartenballiauw?_a=BAMAMicg0","url":"https://daily.dev/sources/maartenballiauw"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/unit-testing-for-validateantiforgerytoken-and-clever-navigation-in-the-resharper-rider-test-runner-dwrsoogdd","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"aspnet,devtools,security,testing","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Maarten Balliauw","item":"https://daily.dev/sources/maartenballiauw"},{"@type":"ListItem","position":3,"name":"Unit testing for ValidateAntiForgeryToken and clever navigation in the ReSharper/Rider test runner"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/unit-testing-for-validateantiforgerytoken-and-clever-navigation-in-the-resharper-rider-test-runner-dwrsoogdd#faq","mainEntity":[{"@type":"Question","name":"How can I write a unit test to find ASP.NET MVC Core action methods missing the ValidateAntiForgeryToken attribute?","acceptedAnswer":{"@type":"Answer","text":"Use reflection to enumerate all public, non-compiler-generated methods on types that extend Controller, filter out methods that only accept GET or HEAD, then feed the results into an xUnit.net [Theory] with [MemberData] that asserts each method has the ValidateAntiForgeryTokenAttribute via GetCustomAttributes(). Methods with no explicit HTTP verb attribute are treated as accepting all verbs and therefore get flagged too. daily.dev surfaces practical testing patterns like this for developers hardening legacy ASP.NET MVC codebases against CSRF."}},{"@type":"Question","name":"How do I make ReSharper or Rider's test runner navigate directly to the failing action method instead of just the test method?","acceptedAnswer":{"@type":"Answer","text":"Throw a custom exception extending XunitException with a stack trace string formatted as \"at {controller}.{actionMethod.Name}() in {actionMethod.DeclaringType.Name}:line 0\" passed as the second base constructor argument. ReSharper and Rider parse that fake stack trace line and offer Ctrl+Click navigation straight to the referenced class and method, even though the line number is arbitrary. daily.dev collects tool-level productivity tricks like this for engineers debugging failing test suites in Rider or ReSharper."}},{"@type":"Question","name":"Should I use AutoValidateAntiforgeryTokenAttribute or explicit ValidateAntiForgeryToken attributes for CSRF protection in ASP.NET Core?","acceptedAnswer":{"@type":"Answer","text":"Both approaches work: AutoValidateAntiforgeryTokenAttribute can be applied as a global filter to validate anti-forgery tokens by default for all HTTP methods except GET, HEAD, OPTIONS, and TRACE, with IgnoreAntiforgeryTokenAttribute for exceptions. An explicit per-action [ValidateAntiForgeryToken] attribute approach, enforced via a unit test, is preferred by some developers for clarity about which HTTP methods and CSRF protections each action supports. daily.dev helps developers weighing global filters versus explicit attributes decide on the right CSRF strategy."}}]} ```