Is ValidateAntiForgeryToken autoimplemented with POST?

Question

I'm reading POST is considered secure and GET no, and that we should implement [ValidateAntiForgeryToken] in every action of every controller.

The question is: need I use the [ValidateAntiForgeryToken] data annotation when I use [POST]?

Answer 1

It's off by default.
There's good reason for this. Not every POST has to come from a form (especially true since your question is tagged asp.net-core)

You should decorate your controller action with the [ValidateAntiForgeryToken]

[ValidateAntiForgeryToken]
public IActionResult Post(Model model)
{
    // ... etc
}

If you're using the form tag helper, it will automatically add the anti forgery token for you, into the <form> markup.

The markup generated will look something like:

<form action="/MyController" method="post">
    <input name="__RequestVerificationToken" type="hidden" value="fhTFfhkKNsdfhYazFtN6c4YbZAmsEwG0srqlUqqloi/OIJOIJoijojhishg" />
    <!-- rest of form here -->
</form>

Note: You can also manually enable/disable __RequestVerificationToken generation using the form helper tags:

<form
 asp-controller="MyController" 
 asp-action="MyAction" 
 asp-antiforgery="false" 
 method="post">