I have the general MVC application which renders the views. From the UI, I directly call my .NET Core API which does all the tasks of GET, POST, PUT & DELETE of resources.

I want to know if somehow cross-site request forgery is applicable in my scenario, If Yes then the token generated via normal MVC application gets validated in .NET Core API? Which approach Should I follow to implement cross-site request forgery in my scenario.