try fix

Author: DeagleGross

src/BenchmarksApps/Antiforgery/Program.cs

@@ -1,4 +1,5 @@
 using Microsoft.AspNetCore.Antiforgery;
+using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.Logging;
 
 var builder = WebApplication.CreateBuilder(args);
@@ -59,8 +60,7 @@
 app.MapGet("/", () => Results.Ok("hello world!"));
 
 // POST endpoint guarded only by the auto-injected cross-origin CSRF protection.
-// Sec-Fetch-Site: same-origin/none => 200; cross-site/same-site => 400.
-app.MapPost("/csrf", () => Results.Ok());
+app.MapPost("/csrf", ([FromForm] string name) => Results.Ok());
 
 // Token-based antiforgery endpoints. These depend on IAntiforgery, which is only
 // registered when the token-based antiforgery services are added above.

src/BenchmarksApps/Antiforgery/scripts/wrk-csrf.lua

@@ -1,7 +1,9 @@
--- POSTs to /csrf to exercise the auto-injected cross-origin (Sec-Fetch) CSRF protection.
--- The Sec-Fetch-Site header is supplied per scenario via the wrk `customHeaders` variable
--- ("same-origin" => accepted/200, "cross-site" => rejected/400). wrk delivers script `--`
--- arguments only to init(args), so the header is sent through wrk's native --header instead
--- to guarantee the value reliably reaches the server.
+-- POSTs a form to /csrf to exercise the auto-injected cross-origin (Sec-Fetch) CSRF protection.
+-- The endpoint binds [FromForm], so the request carries a urlencoded body; reading the form is what
+-- triggers the (post-#67082 lazy) CSRF verdict. The Sec-Fetch-Site header is supplied per scenario
+-- via the wrk `customHeaders` variable ("same-origin" => accepted/200, "cross-site" => rejected/400)
+-- so it reliably reaches the server through wrk's native --header.
 
 wrk.method = "POST"
+wrk.headers["Content-Type"] = "application/x-www-form-urlencoded"
+wrk.body = "name=benchmark"