From 39c38985a53998befae08b3c26d7d196326ad45e Mon Sep 17 00:00:00 2001
From: Gladwin Johnson <90415114+gladjohn@users.noreply.github.com>
Date: Tue, 7 Jul 2026 07:04:23 -0700
Subject: [PATCH] Potential fix for code scanning alert no. 35: Missing
 cross-site request forgery token validation

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 .../TodoListService/Controllers/TodoListController.cs            | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/DevApps/B2CWebAppCallsWebApi/TodoListService/Controllers/TodoListController.cs b/tests/DevApps/B2CWebAppCallsWebApi/TodoListService/Controllers/TodoListController.cs
index 6f2066599..43dbfc351 100644
--- a/tests/DevApps/B2CWebAppCallsWebApi/TodoListService/Controllers/TodoListController.cs
+++ b/tests/DevApps/B2CWebAppCallsWebApi/TodoListService/Controllers/TodoListController.cs
@@ -59,6 +59,7 @@ public void Delete(int id)
         // POST api/values
         [HttpPost]
         [RequiredScope("write")]
+        [ValidateAntiForgeryToken]
         public IActionResult Post([FromBody] Todo todo)
         {
             int id = TodoStore.Values.OrderByDescending(x => x.Id).FirstOrDefault().Id + 1;