title: Is anti forgery token added automatically, even without explicit [AutoValidateAntiforgeryToken]?
body: <p><strong>Context</strong></p>
  <p>I've noticed that after creating a new ASP.NET Core Razor page application in VS 2019 from its out of the box template, even the <strong>purest</strong> html form with the <strong>purest</strong> model class renders output with <code>&lt;input name=&quot;__RequestVerificationToken&quot; type=&quot;hidden&quot; value=&quot;...&quot;&gt;</code></p>
  <p><strong>Question</strong></p>
  <p>Am I missing something and there is somewhere an explicit attribute/statement which instructs ASP.NET Core to add anti forgery or now this is the default? (which makes using <code>[AutoValidateAntiforgeryToken]</code> obsolete)</p>
  <p>...or...</p>
  <p>It is just the <code>&lt;input name=&quot;__RequestVerificationToken&quot; type=&quot;hidden&quot; value=&quot;...&quot;&gt;</code> which is rendered always <strong>unconditionally</strong> and with the <code>[AutoValidateAntiforgeryToken]</code>I can turn on the server side validation against it? This case how can I smoke test if validation is in effect or not?</p>
  <p><strong>Sample Code</strong></p>
  <pre><code>@page
  @model TestFormModel
  @{
      ViewData[&quot;Title&quot;] = &quot;Home page&quot;;
  }
  
  &lt;div class=&quot;text-center&quot;&gt;
      &lt;form method=&quot;post&quot;&gt;
          &lt;input type=&quot;text&quot; name=&quot;myinput&quot;/&gt;
          &lt;input type=&quot;submit&quot; value=&quot;Submit&quot; /&gt;
      &lt;/form&gt;
  &lt;/div&gt;
  
  //[AutoValidateAntiforgeryToken]
  public class TestFormModel : PageModel
  {
      private readonly ILogger&lt;TestFormModel&gt; _logger;
  
      public TestFormModel(ILogger&lt;TestFormModel&gt; logger)
      {
          _logger = logger;
      }
  
      public void OnGet()
      {
  
      }
  
      public void OnPost()
      {
  
      }
  }
  </code></pre>