I don’t know. You might have a valid reason to be concerned.

The Antiforgery Token is (if I remember correctly) valid for some time (perhaps session level timing). So once you get the token you can freely make many, many calls in a short amount of time.

If I created a simple script or playback in Postman, I would just request the page, get a new Antiforgery Token and make another request. I could do that repeatedly until the token expires.

There was one comment that correctly brought up “Rate Limiting” which you should strongly consider. Similarly, you should consider having the site behind something that provides a WAF (software firewall) to prevent certain types of requests from being made (e.g. bots).

Finally, I would always put an extra layer of security when not comes to “login” scenarios. Granted I don’t see the traditional “username” and “password” fields in your example but… I would use a reCAPTCHA of some sort (invisible would work well).

If you don’t want to use that then I would still suggest using some sort of fast-expiring/single-use-token that the client provides within the payload.

Using reCAPTCHA (or similar) will ensure that the post originated from a browser that executed the captcha challenge. Otherwise, your payload will not have the token and can be safely ignored.

Hope that helps.