CA5391 ("Use antiforgery tokens... ") but for API controllers binding FromForm or IFormFile

[AnthonyMastrean]

A classic API controller, not a minimal API, binding FromForm or IFormFile should participate in antiforgery. The only way to do that is with this new [RequireAntiforgeryToken] attribute.

It would be nice to have a rule like CA5391.

[ApiController]
public class ExampleController
{
    [HttpPost] 
    public void PostA([FromForm] IFormFile file) { ... } // ❌ 

    [HttpPost]
    [RequiredAntiforgeryToken]
    public void PostB([FromForm] IFormFile file) { ... } // ✅ 
}

It would be nice if this were documented, but it is not. I have opened a separate issue in the documentation repository (dotnet/AspNetCore.Docs#33740).

https://learn.microsoft.com/en-us/aspnet/core/security/anti-request-forgery?view=aspnetcore-8.0