In this post, there is a paragraph that mentions a scenario where there is no need to validate anti-forgery token in login page:
When is it OK to leave off the anti-forgery token? In general, if the target is a URL, and accessing that URL has no side effects, then you don't need to include anti-forgery token in that URL.
I understand how a CSRF attack works but I am quite lost at this paragraph unfortunately. It says:
- If the target is a URL
- If accessing that URL has no side effects
Is there a target that is not URL? and what is an example for a "side effect"?
I have an ASP.NET MVC application that is hosted at a URL such as subdomain.domain.com. My users receive these errors:
“The provided anti-forgery token was meant for a different claims-based user than the current user.”
“The anti-forgery cookie token and form field token do not match.”
“The provided anti-forgery token was meant for user "", but the current user is > "XYZ".”
In other words, my question is that what are the scenarios in which it is okay not to use anti-forgery token in login page?