Rename ASP.NET Core's antiforgery cookie and maintain random part

Question

ASP.NET Core's anti-forgery cookie name is .AspNetCore.Antiforgery.XXX where the last bit is random.

The cookie can be renamed like so:

builder.Services.AddAntiforgery(x => x.Cookie.Name = "Foo");

But that will produce a cookie named Foo rather than Foo.XXX.

The options object has a field AntiforgeryOptions.DefaultCookiePrefix. Unfortunately it's readonly.

What is the purpose of the random substring (and is it really random or some sort of key?), and how can I rename the cookie so it still has that substring?

Answer 1

solution for .NET 8

define the following class:

internal class UnsafeAccessorClassAntiforgeryOptions
{
    [UnsafeAccessor(UnsafeAccessorKind.StaticField, Name = "DefaultCookiePrefix")]
    public static extern ref string GetUnsafeStaticFieldDefaultCookiePrefix(AntiforgeryOptions obj);
}

then in Program.cs as the first line:

UnsafeAccessorClassAntiforgeryOptions.GetUnsafeStaticFieldDefaultCookiePrefix(new()) = ".AntiForgery.";

more info about UnsafeAccessorAttribute at:

https://medium.com/@malarsharmila/introduction-to-the-unsafeaccessorattribute-class-in-net-8-0-d3a55ec15762