On a customer site, we have implemented multiple Sitecore 9 Forms on the same page. One of these forms is used to sign-in to the website.

When customers submit the sign-in form, the other forms seem to be triggered as well – the next form will throw an error like this:

Anti forgery token is meant for user “” but the current user is “username”

This was a common problem in Sitecore when having multiple MVC forms on a page at the same time. The workaround for MVC forms is to add the ValidateRenderingToken attribute to all the POST methods before the ValidateAntiForgeryToken attribute. The ValidateRenderingToken stops the execution of any method that wasn’t triggered by the submitted form.

How to use the AntiForgeryToken with a custom log-in form?


We need to do something similar for our Sitecore 9 Forms, but we don’t have an MVC Action method – we’re working with Form Submit Actions instead.

Has anyone faced this issue before? Do you have an idea how to resolve the problem?

  • Faced the same issue long time ago, the reason was enabled Caching on rendering that is used for form, make sure that Caching is disabled or as least "Vary By User".
    – x3mxray
    Feb 28, 2020 at 14:16
  • We've checked. This doesn't appear to be a caching issue, although that is another common cause of this problem.
    – dthrasher
    Feb 29, 2020 at 15:29
  • 1
    Load balancing issue?
    – MStodd
    Mar 3, 2020 at 22:44
  • reinoudvandalen.nl/blog/…
    – Abhay Dhar
    Mar 5, 2020 at 5:54

2 Answers 2


I haven’t seen Sitecore Forms in-depth lately, but I am with you when you mention about the challenges in having multiple forms in Sitecore MVC in general.

Looking into the Sitecore ExperienceForms implementation, maybe I could suggest a couple of options:

  1. Override the Form Submit handler Controller and add the attribute directly to Sitecore.ExperienceForms.Mvc.Controllers.FormBuilderController inherited class

    • Referenced in App_Config\Sitecore\ExperienceForms\Sitecore.ExperienceForms.Mvc.config
    • Maybe setting the attribute before the ValidateFromRequest attribute

      public ActionResult Index(FormDataModel data)
          object sessionId;
         if (data == null)
              return this.Index();
         if (data.NavigationData.NavigationType == NavigationType.Submit)
  2. Or, register it in the MVC Global filters. In Sitecore, they are set in Sitecore.Mvc.Pipelines.Loader.InitializeGlobalFilters Processor

    • Referenced App_Config\Sitecore\Mvc\Sitecore.Mvc.config
    • So either you could have another processor after this one to add your own to GlobalFilters.Filters.Add()
    • Or, Use the Attribute Actions in the mvc.actionExecuting pipeline
    • Referenced in App_Config\Sitecore\Mvc\Sitecore.Mvc.config

    public class PipelineBasedRequestFilter : IActionFilter, IResultFilter, IExceptionFilter { public PipelineBasedRequestFilter() { }

    public virtual void OnActionExecuted(ActionExecutedContext actionExecutedContext)
        Assert.ArgumentNotNull(actionExecutedContext, "actionExecutedContext");
        using (IDisposable disposable = TraceBlock.Start("Action Executed"))
            ActionExecutedArgs actionExecutedArg = new ActionExecutedArgs(actionExecutedContext);
            PipelineService.Get().RunPipeline<ActionExecutedArgs>("mvc.actionExecuted", actionExecutedArg);
    public virtual void OnActionExecuting(ActionExecutingContext actionExecutingContext)
        Assert.ArgumentNotNull(actionExecutingContext, "actionExecutingContext");
        using (IDisposable disposable = TraceBlock.Start("Action Executing"))
            ActionExecutingArgs actionExecutingArg = new ActionExecutingArgs(actionExecutingContext);
            PipelineService.Get().RunPipeline<ActionExecutingArgs>("mvc.actionExecuting", actionExecutingArg);

I hope this could help.


Had the same problem in my Sitecore 10. Turns out cache was enabled on the parent rendering that had the form within a placeholder. With cache enabled, it renders the same anti forgery token as the 1st time. From the 2nd form submission attempt, it displayed the error.

Disabled cache on the parent rendering container and it works again.

  • How can we disable the cache on the parent rendering container?
    – Vsn
    Oct 22, 2021 at 22:37
  • I had my renderings set up like this: - Page Component - Child Form Rendering (MVC Form) So, just go to your rendering, look for the Caching section and uncheck the Cacheable setting. Dec 8, 2021 at 20:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.