I am developing an ASP.NET Core 3.1 application. I am not using any kind of authentication, session data/logic and form elements. I see the .AspNetCore.Antiforgery cookie in my in my developer console, although I did not call services.AddAntiforgery() in my Startup class.
I found this StackOverflow question with a very unsatisfying accepted answer, since this cookie will still be sent to the client (pointed out by hemp's comment).
So my question is: How do I completely remove this CSFR cookie?
Asp.Net Core adds the anti forgery token automatically to the form.
You need <form method="post" asp-antiforgery="false">, this will omit the anti forgery token.
Even though this documentation of Microsoft says how to prevent Cross Site. There is a lot of material on how to ignore it -> https://learn.microsoft.com/en-us/aspnet/core/security/anti-request-forgery?view=aspnetcore-3.1#aspnet-core-antiforgery-configuration
All the appropriate techniques are listed in the docs.