- If the token is not valid, the action filter does not allow access to the api/contact/send route.
- but when we send the request via our service, we need to add the token in the request header.
- The ASP.NET MVC Framework provides an HTML helper that creates the token for us.
- The contact request is sent by calling an API with anonymous access.
- We have a public web app that allows users to send a contact request from the browser.

@psharpindia: “MVC Web API Anti-Forgery Token AngularJS Client: Oscar Garcia shows a simple way to protect public APIs.” open tweet »