Search code examples
sslantiforgerytoken

Using SSL and AntiForgeryToken

I am developing a website which forces the user to use HTTPS. Do I need to worry about also using the Html.AnitForgeryToken helper?

Solution

  • HTTPS is used to protect the transport of the data only. The AntiForgeryToken is used to prevent CSRF attacks. CSRF attacks are possible with and without HTTPS, which means you still need this protection even if you use HTTPS.