title: How does ValidateAntiForgeryToken fit with Web APIs that can be accessed via web or native app?
body: <p>I'm trying to understand how I will be able to craft an API using ASP.NET Web API which will be protected from <a href="http://www.asp.net/web-api/overview/security/preventing-cross-site-request-forgery-%28csrf%29-attacks" rel="noreferrer">CSRF</a>, while still being accessible from non-web environments (e.g. native mobile applications).</p>
  
  <p>My first thought would be that a non-web environment can never successfully pass an anti-forgery token validation, since it doesn't have a form that is posted.  Is this true?  Is there any way to make validation work?</p>
  
  <p>If there isn't a way to validate, my second thought is to offer an API which validates anti-forgery tokens for web calls but not for non-web calls.  However, it seems like an attacker would just as easily be able to use this "non-web" API for a CRSF attack, right?</p>
  
  <p>Is the answer that the non-web API needs to only support a non-web authentication mechanism (OAuth?), so that requests to it cannot be replayed via a browser?  Or is there a simpler way?</p>
  
  <p>If that's the only way, is there an easy way to turn off all of the insecure authentication mechanisms?  Shouldn't there be a somewhat simple/happy path in ASP.NET Web API to support these scenarios?</p>