title: How to make Web Api secure against CSRF attacks in ASP.NET?
body: <p>Consider a web application that consists of only HTML and JS for Front end and that communicates with a Web API.</p>
  
  <p>I am trying to protect my application against CSRF attacks and for that I have took reference of <a href="https://dotnetthoughts.net/preventing-cross-site-request-forgery-csrf-attacks-in-webapi/" rel="nofollow noreferrer">this article</a>.</p>
  
  <p>Using the methods in this article, I am able to generate Anti CSRF tokens and pass it to the client. However it depends on first AJAX call that must happen before making regular CRUD operation calls.</p>
  
  <p>With this approach, I need some clarity on few things as well as some alternatives if any. Consider a client visits this web application (which is protected by AJAX based Anti CSRF token), and keeping his session open, he visits a malicious website that contains page that makes the same AJAX calls to get CSRF tokens (assume that attacker is aware of this process), I suppose he can use the headers to make unintended calls thus resulting in an attack.</p>
  
  <p>So how can I protect my application against these?</p>
  
  <p>Please provide more detail regarding this, or if its misleading then help me by providing correct details so that I can tackle it better.</p>