Add reference doc for automatic CSRF protection in .NET 11

[DeagleGross]

Summary

Adds a new reference doc at aspnetcore/security/csrf-protection.md documenting the new automatic Cross-Site Request Forgery (CSRF) protection middleware shipping in .NET 11 (implementation PR: dotnet/aspnetcore#66585, issue: dotnet/aspnetcore#65127).

The new middleware is auto-injected by WebApplication.CreateBuilder and validates Sec-Fetch-Site and Origin headers rather than synchronized tokens. It's additive to the existing token-based antiforgery system documented in security/anti-request-forgery.md; the two coexist.

What's in the doc

• How it works — 6-step decision flow (safe methods → Sec-Fetch-Site → resolved CORS policy → Sec-Fetch-Site deny → Origin-vs-Host fallback → non-browser allow), with a short subsection on why Sec-Fetch-Site and Origin are trustworthy (forbidden request headers — JS can't override them).
• Default behavior — minimal app is already protected; integration with .DisableAntiforgery() and [IgnoreAntiforgeryToken].
• Allowing cross-origin clients — how the middleware reuses the CORS-resolved policy (per-endpoint named → default → fall through). AllowAnyOrigin is intentionally not honored as a CSRF trust signal. [DisableCors] is not a CSRF opt-out.
• Opting an endpoint out — Minimal API .DisableAntiforgery() and MVC [IgnoreAntiforgeryToken], both bridged to the same IAntiforgeryMetadata in .NET 11.
• Disabling globally — DisableCsrfProtection config key.
• Browser support — modern (Sec-Fetch-Site), legacy (Origin fallback), non-browser (allowed).
• Customizing: implement ICsrfProtection — interface, registration pattern, sample allowlist implementation.
• Interaction with token-based antiforgery — comparison table and coexistence guidance.
• Adopting CSRF-only protection in existing apps — how to remove UseAntiforgery() / token form fields when the app targets modern browsers and doesn't rely on IAntiforgeryAdditionalDataProvider.
• Troubleshooting — 400-from-SPA diagnosis, debug logging category/event name, curl reproducer.

Follow-up commits planned in this PR

This is the first of several files in the plan. Subsequent commits to this branch will add:

• aspnetcore/migration/antiforgery-to-csrf.md — standalone migration / "I just upgraded and my SPA gets 400s" guide.
• aspnetcore/migration/100-to-110/includes/csrf.md plus ## Security section in 100-to-110.md referencing it.
• aspnetcore/release-notes/aspnetcore-11/includes/csrf-protection.md plus a ## Security section in aspnetcore-11.md.
• Callout at the top of the existing aspnetcore/security/anti-request-forgery.md (inside the >= aspnetcore-8.0 moniker block) linking out to this new doc and the migration article.
• aspnetcore/toc.yml entry under Security and a migration entry.

Marked as draft until the follow-ups land.

Verification

All <xref:...> targets resolve against existing uids in the repo:

• security/anti-request-forgery ✓
• security/cors ✓
• security/data-protection/introduction ✓

Code claims (decision flow, MVC bridge, CORS resolution order, config key, log category) were cross-checked against the implementation on dotnet/aspnetcore branch dmkorolev/csrf-pr:

• src/DefaultBuilder/src/Internal/DefaultCsrfProtection.cs
• src/DefaultBuilder/src/Internal/CsrfProtectionMiddleware.cs
• src/DefaultBuilder/src/WebApplicationBuilder.cs
• src/DefaultBuilder/src/WebHost.cs
• src/Http/Http.Abstractions/src/Antiforgery/ICsrfProtection.cs and CsrfProtectionResult.cs
• src/Mvc/Mvc.ViewFeatures/src/Filters/AntiforgeryApplicationModelProvider.cs
• src/Middleware/CORS/src/Infrastructure/CorsEndpointConventionBuilderExtensions.cs

---

Internal previews

📄 File	🔗 Preview link
aspnetcore/migration/antiforgery-to-csrf.md	aspnetcore/migration/antiforgery-to-csrf
aspnetcore/security/csrf-protection.md	aspnetcore/security/csrf-protection
aspnetcore/toc.yml	aspnetcore/toc