RequestVerificationToken does not match

Question

I have a problem with the anti CRSF MVC mechanism. The cookie and the form input returned does not match. I\'m getting an error every single time, only in one specific page.

Answer 1

From my recent findings ...

If you set content type as "application/x-www-form-urlencoded" in the ajax request then you must put the AFRT in the data

If you set the content type to "application/json" then the token goes in the ajax "headers" property as described by haack.

On the server if you are checking for the form type token then using the vanilla AntiForgeryRequestTokenAttribute is ok but if you want to validate tokens sent in the header then you need to call the AntiForgeryToken.OnAuthorize ... or whatever, passing the token from the cookie (http context).

It aint easy but if it was everybody would be doing it :)