Search code examples
csrfantiforgerytoken

How does AntiForgeryToken work

I'm in trying to protect from CSRF and have two scenarious:

  1. Doing POST from within another site and it fails when I enable AntiForgeryToken
  2. I have tried from my "malicious" Javascript (running on another site) to first do GET of the page, parse it and extract RequestVerificationToken and then do a POST. This also fails but it is unclear to me why?

Can anyone please explain why?

Solution

  • For security reasons, you cannot retrieve content from another domain using AJAX.

    Therefore, other sites cannot get your token.