2

On a customer site, we have implemented multiple Sitecore 9 Forms on the same page. One of these forms is used to sign-in to the website.

When customers submit the sign-in form, the other forms seem to be triggered as well – the next form will throw an error like this: Anti forgery token is meant for user “” but the current user is “username”

This was a common problem in Sitecore when having multiple MVC forms on a page at the same time. The workaround for MVC forms is to add the ValidateRenderingToken attribute to all the POST methods before the ValidateAntiForgeryToken attribute. The ValidateRenderingToken stops the execution of any method that wasn’t triggered by the submitted form.

How to use the AntiForgeryToken with a custom log-in form?

https://stackoverflow.com/questions/14970102/anti-forgery-token-is-meant-for-user-but-the-current-user-is-username

We need to do something similar for our Sitecore 9 Forms, but we don’t have an MVC Action method – we’re working with Form Submit Actions instead.

Has anyone faced this issue before? Do you have an idea how to resolve the problem?

  • Faced the same issue long time ago, the reason was enabled Caching on rendering that is used for form, make sure that Caching is disabled or as least "Vary By User". – x3mxray Feb 28 at 14:16
  • We've checked. This doesn't appear to be a caching issue, although that is another common cause of this problem. – dthrasher Feb 29 at 15:29
  • 1
    Load balancing issue? – MStodd Mar 3 at 22:44
0

I haven’t seen Sitecore Forms in-depth lately, but I am with you when you mention about the challenges in having multiple forms in Sitecore MVC in general.

Looking into the Sitecore ExperienceForms implementation, maybe I could suggest a couple of options:

  1. Override the Form Submit handler Controller and add the attribute directly to Sitecore.ExperienceForms.Mvc.Controllers.FormBuilderController inherited class

    • Referenced in App_Config\Sitecore\ExperienceForms\Sitecore.ExperienceForms.Mvc.config
    • Maybe setting the attribute before the ValidateFromRequest attribute

      [HttpPost]
      [ValidateFormRequest]
      public ActionResult Index(FormDataModel data)
      {
          object sessionId;
         if (data == null)
         {
              return this.Index();
         }
         if (data.NavigationData.NavigationType == NavigationType.Submit)
         ...
      
  2. Or, register it in the MVC Global filters. In Sitecore, they are set in Sitecore.Mvc.Pipelines.Loader.InitializeGlobalFilters Processor

    • Referenced App_Config\Sitecore\Mvc\Sitecore.Mvc.config
    • So either you could have another processor after this one to add your own to GlobalFilters.Filters.Add()
    • Or, Use the Attribute Actions in the mvc.actionExecuting pipeline
    • Referenced in App_Config\Sitecore\Mvc\Sitecore.Mvc.config

    public class PipelineBasedRequestFilter : IActionFilter, IResultFilter, IExceptionFilter { public PipelineBasedRequestFilter() { }

    public virtual void OnActionExecuted(ActionExecutedContext actionExecutedContext)
    {
        Assert.ArgumentNotNull(actionExecutedContext, "actionExecutedContext");
        using (IDisposable disposable = TraceBlock.Start("Action Executed"))
        {
            ActionExecutedArgs actionExecutedArg = new ActionExecutedArgs(actionExecutedContext);
            PipelineService.Get().RunPipeline<ActionExecutedArgs>("mvc.actionExecuted", actionExecutedArg);
        }
    }
    
    public virtual void OnActionExecuting(ActionExecutingContext actionExecutingContext)
    {
        Assert.ArgumentNotNull(actionExecutingContext, "actionExecutingContext");
        using (IDisposable disposable = TraceBlock.Start("Action Executing"))
        {
            ActionExecutingArgs actionExecutingArg = new ActionExecutingArgs(actionExecutingContext);
            PipelineService.Get().RunPipeline<ActionExecutingArgs>("mvc.actionExecuting", actionExecutingArg);
        }
        ...
    

I hope this could help.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.