Hi All,
I working with implementing XSRF protection for our ASP.Net MVC project.
I added @Html.AntiForgeryToken() in my razor form (in the layout page) to have the AF token generated. I'm passing this __RequestVerificationToken for each request under request header.
We've a custom AFT handler which validates the token for each request (algorithm as below).
Step 1: Read the AFT cookie value. (var cookie = System.Web.HttpContext.Current.Request.Cookies[AntiForgeryConfig.CookieName];)
Step 2: Read the passed header value and assign it to a variable called formToken
Step 3: Perform validation. (AntiForgery.Validate(cookie.Value, formToken);)
When I run the application, the validation works fine. But if I close the tab (without closing the browser) and reopen another tab and try the page, the validation fails saying "The provided anti-forgery token was meant for a different claims-based user
than the current user".
So ...
Go to the complete details ...