Why does DefaultAntiforgeryAdditionalDataProvider.GetAdditionalData() return an empty string?

Question

I'm debugging the Antiforgery code in the Asp.Net Core source code and found this:

Does anyone know what the purpose is of having a method that returns an empty string?

Answer 1

The method is needed, because the IAntigorgeryAdditionalDataProvider interface requires it:

Provides additional data to be stored for the antiforgery tokens generated during this request.

This is just the default (or dummy) implementation, which has no additonal data. If you want to transfer additional data, you need to create your own implementation and register it to the ServiceCollection:

services.AddSingleton<IAntiforgeryAdditionalDataProvider, MyProvider>();