Skip HttpContext.Items allocation in CsrfProtectionMiddleware hot path

[DeagleGross]

Fixes degradation noticed by @BrennanConroy (thanks!) #67119 (comment)

CsrfProtectionMiddleware was unconditionally writing MiddlewareInvokedKeys.CsrfProtection to context.Items. I did not run the crank-based tests to confirm allocation improvement, but used a local test (see source code below). The results show that CsrfProtectionMiddleware allocates 0 bytes compared to 264 bytes without the fix.

[Fact]
public async Task CsrfProtection_HotPath_NoEndpointMetadata_DoesNotAllocateItemsDictionary()
{
    var middleware = new Microsoft.AspNetCore.Antiforgery.CsrfProtectionMiddleware(
        next: _ => Task.CompletedTask,
        csrfProtection: new AlwaysAllowCsrfProtection(),
        logger: NullLoggerFactory.Instance.CreateLogger<Microsoft.AspNetCore.Antiforgery.CsrfProtectionMiddleware>());

    var endpoint = new Endpoint(
        requestDelegate: _ => Task.CompletedTask,
        metadata: new EndpointMetadataCollection(),
        displayName: "plaintext");

    static DefaultHttpContext NewContext(Endpoint endpoint)
    {
        var ctx = new DefaultHttpContext();
        ctx.SetEndpoint(endpoint);
        return ctx;
    }

    for (var i = 0; i < 200; i++)
    {
        await middleware.InvokeAsync(NewContext(endpoint));
    }

    const int Iterations = 5_000;

    GC.Collect(); GC.WaitForPendingFinalizers(); GC.Collect();
    var before = GC.GetAllocatedBytesForCurrentThread();
    for (var i = 0; i < Iterations; i++)
    {
        await middleware.InvokeAsync(NewContext(endpoint));
    }
    var bytesPerRequest = (double)(GC.GetAllocatedBytesForCurrentThread() - before) / Iterations;

    GC.Collect(); GC.WaitForPendingFinalizers(); GC.Collect();
    var ctxBefore = GC.GetAllocatedBytesForCurrentThread();
    for (var i = 0; i < Iterations; i++)
    {
        _ = NewContext(endpoint);
    }
    var ctxOnlyPerRequest = (double)(GC.GetAllocatedBytesForCurrentThread() - ctxBefore) / Iterations;

    var middlewareDelta = bytesPerRequest - ctxOnlyPerRequest;
    Assert.True(
        middlewareDelta < 10,
        $"Hot-path allocation regression: middleware added {middlewareDelta:F1} bytes/request " +
        $"on top of DefaultHttpContext baseline ({ctxOnlyPerRequest:F1} bytes).");
}

private sealed class AlwaysAllowCsrfProtection : ICsrfProtection
{
    public ValueTask<CsrfProtectionResult> ValidateAsync(HttpContext context)
        => new(CsrfProtectionResult.Allowed());
}

[Copilot]

Pull request overview

Optimizes the auto-injected CsrfProtectionMiddleware hot path by avoiding unnecessary HttpContext.Items initialization when an endpoint has no antiforgery metadata, while preserving the marker behavior needed for reroute/re-execute scenarios and antiforgery/disable-antiforgery endpoints.

Changes:

• Conditionally stamps the MiddlewareInvokedKeys.CsrfProtection marker only when endpoint is null or when IAntiforgeryMetadata is present.
• Updates integration tests to assert the marker is not set for endpoints without antiforgery metadata.

Show a summary per file

File	Description
src/DefaultBuilder/src/Internal/CsrfProtectionMiddleware.cs	Avoids HttpContext.Items allocation by not stamping the marker on the no-antiforgery-metadata path.
src/DefaultBuilder/test/Microsoft.AspNetCore.Tests/CsrfProtectionIntegrationTests.cs	Adjusts assertions to reflect that the marker is not set when the endpoint has no antiforgery metadata.

Copilot's findings

• Files reviewed: 2/2 changed files
• Comments generated: 1