4

There may be several forms on any given page of our site. Distinguishing between post requests from these forms is implemented using ValidateRenderingToken. There is also AntiForgeryToken / validation defined for every form.

One of these forms is the log-in / log-out form in the header. My problem is currently this error when logging in:

The provided anti-forgery token was meant for user "", but the current user is "extranet\someuser".

And this error when logging out (previously logged in as an admin):

The provided anti-forgery token was meant for user "sitecore\admin", but the current user is "".

As I understand, this is because the user is changed in the middle of the request, and the [ValidateAntiForgeryToken] attribute for all subsequent post handlers on the page gets called anyway and fails. This is despite having a [ValidateRenderingToken] attribute on every POST handler:

[HttpPost]
[ValidateRenderingToken]
[ValidateAntiForgeryToken]
public ActionResult Index(SomeModel model)
{
    // ...
}

The only solution that comes to mind is to somehow postpone the login/logout procedure until the end of the request, when all anti-forgery validation has been executed. Is there a better, more standard way of handling the log-in / log-out procedure with multiple secured forms on the page?

3

I found the root of the issue. It was caused by some controller actions, for which:

  • Either the [ValidateRenderingToken] attribute was missing;
  • Or the [ValidateRenderingToken] attribute was added after the [ValidateAntiForgeryToken] attribute, thus changing the execution order.
  • 1
    Ah, clear. So first it was checking the AntiForgeryToken and then it was checking the form that it was really from that form where you sent the POST. I think you can mark this as answer. It could be really helpful for others. – Tamás Tárnok Feb 1 '17 at 9:47

Not the answer you're looking for? Browse other questions tagged or ask your own question.