title: ValidateAntiForgeryToken in an ASP.NET Core React SPA Application
body: <p>I'm trying to use the framework's tools to add some simple CSRF validation to an ASP.NET Core React SPA.  The application itself is essentially a create-react-app setup (a single index.html with a root element and everything else is loaded in from bundled JavaScript).</p>
  
  <p>Tinkering with some information found on links such as <a href="https://docs.microsoft.com/en-us/aspnet/core/security/anti-request-forgery?view=aspnetcore-2.1" rel="noreferrer">this one</a>, I've set the following in my <code>Startup.ConfigureServices</code>:</p>
  
  <pre><code>services.AddAntiforgery(options =&gt; options.Cookie.Name = "X-CSRF-TOKEN");
  </code></pre>
  
  <p>And confirmed in my Chrome tools that the cookie is being set.  If I omit the above line, a cookie is still set with a partially randomized name, such as: <code>.AspNetCore.Antiforgery.RAtR0X9F8_w</code>  Either way the cookie is being set.  I've also confirmed that any time I re-start the whole application the cookie value is updated, so the framework is actively setting this cookie.</p>
  
  <p>Observing network requests in my Chrome tools, I confirm that the cookie is being sent to the server on AJAX request.  Placing a breakpoint on the server and observing the <code>Request.Cookies</code> value in a controller action also confirms this.</p>
  
  <p>However, if I decorate any such AJAX requested action with <code>[ValidateAntiForgeryToken]</code> then the response is always an empty 400.</p>
  
  <p>Is there a configuration step I've missed somewhere?  Perhaps the action attribute is looking in the wrong place and I need to use a different validation?</p>