To summarize my comments:
XSRF/CSRF is only possible when you use Cookies for authentication. It allows attackers to lure users to a fake page which redirects a (typically hidden) form to your website with data filled by the attacker or by calling scripts in image tags (if get requests have side-effects, which should be avoided) , i.e.
<image src="http://yourdomain.com/user/5/delete"/>
When you use SPA (Single Page Application, Applications written in JavaScript where they are loaded only by the initial request and every other call happens via Ajax/JavaScript), then you would typically use Access Tokens (opaque token or jwt tokes) to authenticate.
Sending Tokens with each request is not vulnerable to XSRF, only if you use cookie authentication. The ASP.NET Core documentation explicitly states that:
https://docs.microsoft.com/en-us/aspnet/core/security/anti-request-forgery
Some attacks target site endpoints that respond to GET requests, in which case an image tag can be used to perform the action (this form of attack is common on forum sites that permit images but block JavaScript). Applications that change state with GET requests are vulnerable from malicious attacks.
CSRF attacks are possible against web sites that use cookies for authentication, because browsers send all relevant cookies to the destination web site. However, CSRF attacks are not limited to exploiting cookies. For example, Basic and Digest authentication are also vulnerable. After a user logs in with Basic or Digest authentication, the browser automatically sends the credentials until the session ends.
与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…