github
diff --git a/‎csharp/ql/src/change-notes/2026-08-27-csrf-autovalidate.md‎
Lines changed: 4 additions & 0 deletions b/‎csharp/ql/src/change-notes/2026-08-27-csrf-autovalidate.md‎
Lines changed: 4 additions & 0 deletions
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The `cs/web/missing-token-validation` query now recognizes an ASP.NET Core `AutoValidateAntiforgeryTokenAttribute` registered as a global MVC filter through `AddControllersWithViews` (and friends), avoiding false-positive results for covered actions.
-Original file line number
+Diff line change
@@ @@ -0,0 +1,4 @@ @@
 +---
 +category: minorAnalysis
 +---
 +* The `cs/web/missing-token-validation` query now recognizes an ASP.NET Core `AutoValidateAntiforgeryTokenAttribute` registered as a global MVC filter through `AddControllersWithViews` (and friends), avoiding false-positive results for covered actions.