Posted on: 3/2/2015 4:05:36 PM | Views : 2361

Hi All,
I working with implementing XSRF protection for our ASP.Net MVC project. I added @Html.AntiForgeryToken() in my razor form (in the layout page) to have the AF token generated. I'm passing this __RequestVerificationToken for each request under request header. We've a custom AFT handler which validates the token for each request (algorithm as below).
Step 1: Read the AFT cookie value. (var cookie = System.Web.HttpContext.Current.Request.Cookies[AntiForgeryConfig.CookieName];) Step 2: Read the passed header value and assign it to a variable called formToken Step 3: Perform validation. (AntiForgery.Validate(cookie.Value, formToken);)
When I run the application, the validation works fine. But if I close the tab (without closing the browser) and reopen another tab and try the page, the validation fails saying "The provided anti-forgery token was meant for a different claims-based user than the current user".
So ...

Go to the complete details ...