Skip to content

Commit 74bf1b4

Browse files
Update anti-request-forgery for multiple tabs
Fixes #25564
1 parent e942dec commit 74bf1b4

File tree

1 file changed

+1
-3
lines changed

1 file changed

+1
-3
lines changed

aspnetcore/security/anti-request-forgery.md

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -159,9 +159,7 @@ Calling <xref:Microsoft.Extensions.DependencyInjection.MvcServiceCollectionExten
159159

160160
## Multiple browser tabs and the Synchronizer Token Pattern
161161

162-
With the Synchronizer Token Pattern, only the most recently loaded page is guaranteed to contain a valid antiforgery token. Apps that wish to support multiple tabs should test supported browsers and log failures. ***Using multiple tabs can be problematic***. For example, if a user opens multiple tabs, requests made from previously loaded tabs might fail with an error: `Antiforgery token validation failed. The antiforgery cookie token and request token do not match`
163-
164-
Consider alternative CSRF protection patterns if this poses an issue.
162+
Multiple tabs with different uses is not supported, including a user and anonymous.
165163

166164
## Configure antiforgery with `AntiforgeryOptions`
167165

0 commit comments

Comments
 (0)