Why I am getting the csrf token cookie in the request header?

See more:

C#

ASP.NET

CSRF

I am creating CSRF Token Cookie as part of the security fix against csrf forgery attack. Token is visible in the request headers and not in the response headers while checking via developer tools and hence there is a chance of information leakage.

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cache-Control: max-age=0
Connection: keep-alive
Cookie: .ASPXAUTH=; ASP.NET_SessionId=b1tud33l5vsixs5sm1dgxpay; __AntiXsrfToken=7d38e61dee524d74af2918c643cb1554

What I have tried:

I am setting CSRF Token Cookie as below:

Guid requestCookieGuidValue;
                if (requestCookie != null && Guid.TryParse(requestCookie.Value, out requestCookieGuidValue))
                {
                   
                    // Use the Anti-XSRF token from the cookie
                    _antiXsrfTokenValue = requestCookie.Value;
                  
                    Page.ViewStateUserKey = _antiXsrfTokenValue;
                   
                }
                else
                {
                   
                    // Generate a new Anti-XSRF token and save to the cookie
                    _antiXsrfTokenValue = Guid.NewGuid().ToString("N");
                   
                    Page.ViewStateUserKey = _antiXsrfTokenValue;
                    
                    var responseCookie = new HttpCookie(AntiXsrfTokenKey)
                    {
                        HttpOnly = true,
                        Value = _antiXsrfTokenValue
                    };
                    if (FormsAuthentication.RequireSSL && Request.IsSecureConnection)
                    {
                        responseCookie.Secure = true;
                    }
                    Response.Cookies.Set(responseCookie);
                 
                }