Should I always add CancellationToken to my controller actions?
No. You should not always.
Using CancellationTokens in ASP.NET Core MVC controllers
https://andrewlock.net/using-cancellationtokens-in-asp-net-core-mvc-controllers/
Whether this is correct behaviour will depend on your app. If the
request modifies state, then you may not want to halt execution
mid-way through a method. On the other hand, if the request has no
side-effects, then you probably want to stop the (presumably
expensive) action as soon as you can.
So if you have a method/action like below (simplified);
await ProcessOrder();
await UpdateInventory();
You do not want to cancel the order while it is being processed, if so, order can be completed, but you will not update the inventory if user passing through the tunnel, and loses the internet connection.
This is especially important when operations cannot be included in a Unit of Work like pattern (e.g. distributed system) and one should try to minimize cancellations.