The AntiForgeryToken is used to prevent CSRF attacks, however the links on MSDN don't give me much insight to what exactly the AntiForgeryToken does, or how it works, or why things are done the way they are.
From what I gather, it creates a hash inside a web page and a cookie. One or both of them use the hashed
IPrincipal.Name, and use symmetric encryption.
Can anyone shed light as to:
- How the AntiForgeryToken works internally
- What should it be used to protect
- What should it NOT be used to protect
- What is the reasoning behind the implementation choices for #1 above?