I have set up some Sitecore extranet users (8.1.160519). I am using MVC AntiForgeryTokens for some posts. The problem is with the login form explicitly. When I am developing I am logged in as Admin and as one of my extrant users. If I log in as the Admin first, then try to login as my extranet user I get:
The provided anti-forgery token was meant for user "sitecore\admin", but the current user is "extranet\eschofer".
I am tempted to turn off the AntiForgeryToken for the login form, but would prefer to try and mitigate this.
I already tried setting:
AntiForgeryConfig.SuppressIdentityHeuristicChecks = true;
I am not sure I have this in the correct place in the Pipeline but at least right now it has no effect. Here is where it currently exists in the initialize pipeline:
<initialize>
<processor type="Sitecore.Pipelines.Loader.ShowVersion, Sitecore.Kernel">
<processor type="Sitecore.Analytics.Pipelines.Initialize.ShowXdbInfo, Sitecore.Analytics" patch:source="Sitecore.Xdb.config" />
<processor type="Sitecore.Pipelines.Loader.ShowHistory, Sitecore.Kernel" />
<processor type="Sitecore.Pipelines.Loader.SetGlobals, Sitecore.Kernel" />
<processor type="Sitecore.Eventing.Remote.RemoteEventMap, Sitecore.Kernel" method="InitializeFromPipeline" />
<processor type="Sitecore.Pipelines.Loader.LoadHooks, Sitecore.Kernel" />
<processor type="Sitecore.Pipelines.Loader.InitializeManagers, Sitecore.Kernel" />
<processor type="Sitecore.Pipelines.Loader.InitializeScheduler, Sitecore.Kernel" />
<processor type="Sitecore.Pipelines.Loader.InitializeHeartbeat, Sitecore.Kernel" />
<processor type="Sitecore.Pipelines.Loader.InitializeAgilityPack, Sitecore.Kernel" />
<processor type="Sitecore.Pipelines.Loader.EnsureAnonymousUsers, Sitecore.Kernel" />
<!-- Processor checks the WebDAV feature configuration on first start. -->
<processor type="Sitecore.Pipelines.Loader.CheckWebDAVConfiguration, Sitecore.Kernel" patch:source="Sitecore.WebDAV.config" />
###### HERE IS MY PATCH FILE ########
<processor type="DD.Framework.Pipelines.Initialize.InitializeAntiForgeryTokens, DD.Framework" patch:source="Delphic.InitializeAntiForgeryToken.config" />
#######################################
<!--
Replaces the default MediaManager.Cache implementation with one that optimizes images on the way to cache
-->
<processor type="Dianoga.Pipelines.Initialize.MediaCacheReplacer, Dianoga" patch:source="Dianoga.config" />
<processor type="DelawareNorth.App_Start.GlassMapperSc, DelawareNorth" patch:source="Glass.Mapper.Sc.Start.config" />
<processor type="Sitecore.Analytics.Pipelines.Loader.InitializeAutomation,Sitecore.Analytics.Automation" patch:source="Sitecore.Analytics.Automation.TimeoutProcessing.config" />
<processor type="Sitecore.Analytics.Outcome.Pipelines.Initialize.RegisterDataModelExtensions, Sitecore.Analytics.Outcome" patch:source="Sitecore.Analytics.Outcome.config" />
<processor type="Sitecore.Analytics.Automation.Pipelines.Initialize.RegisterDataModelExtensions, Sitecore.Analytics.Automation.MongoDB" patch:source="Sitecore.Analytics.Processing.Aggregation.ProcessingPools.config" />
<processor type="Sitecore.Analytics.Pipelines.Loader.InitializeTracking, Sitecore.Analytics" patch:source="Sitecore.Analytics.Tracking.config" />
<processor type="Sitecore.Analytics.Pipelines.Loader.InitializeAnalytics, Sitecore.Analytics" patch:source="Sitecore.Analytics.Tracking.config" />
<processor type="Sitecore.Apps.TagInjection.Loader.TagInjectionInitializer, Sitecore.Apps.TagInjection" patch:source="Sitecore.Apps.TagInjection.config" />
<processor type="Sitecore.Commerce.Pipelines.RegisterConnectTypesWithMongo, Sitecore.Commerce" patch:source="Sitecore.Commerce.config" />
<!--
DUMP CONFIGURATION FILES Dumps the specified configuration files and allows you to monitor all the changes that are made to the configuration files. Supported child nodes: DumpFolder: The path to the root folder where the config file dump is stored. Each config file dump is stored in a folder or a zip archive. The name of the folder or zip archive has the following format: {date}.{time}. Default value: $(dataFolder)/diagnostics/configuration_history Zip: Boolean value that determines whether each dump should be zipped. Default value: true files: Contains <file> nodes where the "path" attribute value is the path to the configuration file or the folder that should be dumped.
-->
<processor type="Sitecore.Pipelines.Loader.DumpConfigurationFiles, Sitecore.Kernel" patch:source="Sitecore.Diagnostics.config">
<processor type="Sitecore.Pipelines.Loader.InitializeJSNLog, Sitecore.Kernel" patch:source="Sitecore.JSNLog.config" />
<processor type="Sitecore.Mvc.Pipelines.Loader.InitializeGlobalFilters, Sitecore.Mvc" patch:source="Sitecore.Mvc.config" />
<processor type="Sitecore.Mvc.Pipelines.Loader.InitializeControllerFactory, Sitecore.Mvc" patch:source="Sitecore.Mvc.config" />
<processor type="Sitecore.Mvc.Pipelines.Initialize.InitializeCommandRoute, Sitecore.Speak.Mvc" patch:source="Sitecore.Speak.Mvc.config" />
<processor type="Sitecore.ContentTesting.Pipelines.Initialize.RegisterWebApiRoutes, Sitecore.ContentTesting" patch:source="Sitecore.ContentTesting.config" />
<!-- Processor initializes the "Social" MVC area. -->
<processor type="Sitecore.Social.Client.Mvc.Pipelines.Initialize.RegisterSocialArea, Sitecore.Social.Client.Mvc" patch:source="Sitecore.Social.config" />
<processor type="Sitecore.Mvc.Pipelines.Loader.InitializeRoutes, Sitecore.Mvc" patch:source="Sitecore.Mvc.config" />
<!--
One-time run code that synchronizes a segment if it's workflow state is 'Deployed' but non-existent in db, with DeployDate = UTC.NOW
-->
<processor type="Sitecore.ExperienceAnalytics.Client.Deployment.SyncSegmentsProcessor, Sitecore.ExperienceAnalytics.Client" patch:source="Sitecore.ExperienceAnalytics.Client.config">
<!-- Initializing Experience Analytics Web API -->
<processor type="Sitecore.ExperienceAnalytics.Api.Pipelines.Initialize.WebApiInitializer, Sitecore.ExperienceAnalytics" patch:source="Sitecore.ExperienceAnalytics.WebAPI.config">
<!-- Creates client specific http endpoints. -->
<processor type="Sitecore.Cintel.Client.Initialization.InitializeRoutes, Sitecore.Cintel.Client" patch:source="Sitecore.ExperienceProfile.Client.config" />
<!-- Creates a set of http endpoints that expose functionality of Experience Profile. -->
<processor type="Sitecore.Cintel.Endpoint.Plumbing.InitializeRoutes, Sitecore.Cintel" patch:source="Sitecore.ExperienceProfile.config" />
<!--
Maps a specific route for the Beacon Service to allow session state to be enabled as the DMS relies upon the existence of a session.
-->
<processor type="Sitecore.FXM.Service.Pipelines.EnableBeaconServiceSessionStateProcessor, Sitecore.FXM.Service" patch:source="Sitecore.FXM.config" />
<processor type="Delphic.Sitecore.Particle.Pipeline.ParticleStart, Delphic.Sitecore.Particle" patch:source="Particle.config" />
<!-- Processor maps remote events. -->
<processor type="Sitecore.Social.Client.Pipelines.Initialize.RemoteEventMap, Sitecore.Social.Client" patch:source="Sitecore.Social.config" />
</initialize>
