In ASP.NET Core MVC 2.0 the FormTagHelper from the Microsoft.AspNetCore.Mvc.TagHelpers assembly now injects anti-forgery tokens for plain form elements (elements that don't have asp-*). This happens under the following conditions:
Opt your form element out of TagHelperification by using the ! symbol.
<!form method="post">
</!form>
Remove the FormTagHelper entirely from the view.
@removeTagHelper Microsoft.AspNetCore.Mvc.TagHelpers.FormTagHelper, Microsoft.AspNetCore.Mvc.TagHelpers
The change
In ASP.NET Core MVC 2.0 the
FormTagHelper
from theMicrosoft.AspNetCore.Mvc.TagHelpers
assembly now injects anti-forgery tokens for plain form elements (elements that don't haveasp-*
). This happens under the following conditions:method="post"
attributeaction
attribute is empty. e.g.action=""
action
attribute is not suppliedWorkarounds
Explicitly turn off anti-forgery
Opt your form element out of TagHelperification by using the
!
symbol.Remove the
FormTagHelper
entirely from the view.@removeTagHelper Microsoft.AspNetCore.Mvc.TagHelpers.FormTagHelper, Microsoft.AspNetCore.Mvc.TagHelpers