ASP.NET Core Security in .NET 11: Automatic CSRF Protection with Fetch Metadata, Device Bound Session Credentials and TLS Channel Binding
.NET 11 adds CSRF protection, on by default for apps built with WebApplication.CreateBuilder, that checks the Sec-Fetch-Site and Origin headers; yet only form-reading endpoints enforce the verdict and DisableAntiforgery turns it off too. We cover the decision table, origins trusted through CORS, a middleware applying the same rules on .NET 10, experimental DBSC, TLS channel binding, unified authorization metadata and a migration checklist.
8 Nov 2026
·
10 min
·
6
