Multiple Sitecore 9 Forms can cause AntiForgery token validation errors

Question

On a customer site, we have implemented multiple Sitecore 9 Forms on the same page. One of these forms is used to sign-in to the website.

When customers submit the sign-in form, the other forms seem to be triggered as well – the next form will throw an error like this:

Anti forgery token is meant for user “” but the current user is “username”

This was a common problem in Sitecore when having multiple MVC forms on a page at the same time. The workaround for MVC forms is to add the ValidateRenderingToken attribute to all the POST methods before the ValidateAntiForgeryToken attribute. The ValidateRenderingToken stops the execution of any method that wasn’t triggered by the submitted form.

How to use the AntiForgeryToken with a custom log-in form?

https://stackoverflow.com/questions/14970102/anti-forgery-token-is-meant-for-user-but-the-current-user-is-username

We need to do something similar for our Sitecore 9 Forms, but we don’t have an MVC Action method – we’re working with Form Submit Actions instead.

Has anyone faced this issue before? Do you have an idea how to resolve the problem?

Answer 1

I haven’t seen Sitecore Forms in-depth lately, but I am with you when you mention about the challenges in having multiple forms in Sitecore MVC in general.

Looking into the Sitecore ExperienceForms implementation, maybe I could suggest a couple of options:

1. Override the Form Submit handler Controller and add the attribute directly to Sitecore.ExperienceForms.Mvc.Controllers.FormBuilderController inherited class

   • Referenced in App_Config\Sitecore\ExperienceForms\Sitecore.ExperienceForms.Mvc.config

   • Maybe setting the attribute before the ValidateFromRequest attribute

     [HttpPost]
     [ValidateFormRequest]
     public ActionResult Index(FormDataModel data)
     {
         object sessionId;
        if (data == null)
        {
             return this.Index();
        }
        if (data.NavigationData.NavigationType == NavigationType.Submit)
        ...
     

2. Or, register it in the MVC Global filters. In Sitecore, they are set in Sitecore.Mvc.Pipelines.Loader.InitializeGlobalFilters Processor

   • Referenced App_Config\Sitecore\Mvc\Sitecore.Mvc.config
   • So either you could have another processor after this one to add your own to GlobalFilters.Filters.Add()
   • Or, Use the Attribute Actions in the mvc.actionExecuting pipeline
   • Referenced in App_Config\Sitecore\Mvc\Sitecore.Mvc.config

   public class PipelineBasedRequestFilter : IActionFilter, IResultFilter, IExceptionFilter { public PipelineBasedRequestFilter() { }

   public virtual void OnActionExecuted(ActionExecutedContext actionExecutedContext)
   {
       Assert.ArgumentNotNull(actionExecutedContext, "actionExecutedContext");
       using (IDisposable disposable = TraceBlock.Start("Action Executed"))
       {
           ActionExecutedArgs actionExecutedArg = new ActionExecutedArgs(actionExecutedContext);
           PipelineService.Get().RunPipeline<ActionExecutedArgs>("mvc.actionExecuted", actionExecutedArg);
       }
   }
   
   public virtual void OnActionExecuting(ActionExecutingContext actionExecutingContext)
   {
       Assert.ArgumentNotNull(actionExecutingContext, "actionExecutingContext");
       using (IDisposable disposable = TraceBlock.Start("Action Executing"))
       {
           ActionExecutingArgs actionExecutingArg = new ActionExecutingArgs(actionExecutingContext);
           PipelineService.Get().RunPipeline<ActionExecutingArgs>("mvc.actionExecuting", actionExecutingArg);
       }
       ...
   

I hope this could help.

Answer 2

Had the same problem in my Sitecore 10. Turns out cache was enabled on the parent rendering that had the form within a placeholder. With cache enabled, it renders the same anti forgery token as the 1st time. From the 2nd form submission attempt, it displayed the error.

Disabled cache on the parent rendering container and it works again.