The form tag helper will automatically add the anti forgery token. (Unless you use it as a standard html form element, manually adding an action
attribute). Check the source code of the form tag helper, you will see the following at the end of the Process
method.
if (Antiforgery ?? antiforgeryDefault)
{
var antiforgeryTag = Generator.GenerateAntiforgery(ViewContext);
if (antiforgeryTag != null)
{
output.PostContent.AppendHtml(antiforgeryTag);
}
}
If you check the html of the login page, you will see the following hidden input inside the form:
<input name="__RequestVerificationToken" type="hidden" value="CfDJ8BIeHClDdT9...">
You can also manually enable/disable it adding the asp-antiforgery
attribute:
<form asp-controller="Account" asp-action="Register" asp-antiforgery="false" method="post" class="form-horizontal" role="form">