How to use the AntiForgeryToken with a custom log-in form? [closed]

Question

There may be several forms on any given page of our site. Distinguishing between post requests from these forms is implemented using ValidateRenderingToken. There is also AntiForgeryToken / validation defined for every form.

One of these forms is the log-in / log-out form in the header. My problem is currently this error when logging in:

The provided anti-forgery token was meant for user "", but the current user is "extranet\someuser".

And this error when logging out (previously logged in as an admin):

The provided anti-forgery token was meant for user "sitecore\admin", but the current user is "".

As I understand, this is because the user is changed in the middle of the request, and the [ValidateAntiForgeryToken] attribute for all subsequent post handlers on the page gets called anyway and fails. This is despite having a [ValidateRenderingToken] attribute on every POST handler:

[HttpPost]
[ValidateRenderingToken]
[ValidateAntiForgeryToken]
public ActionResult Index(SomeModel model)
{
    // ...
}

The only solution that comes to mind is to somehow postpone the login/logout procedure until the end of the request, when all anti-forgery validation has been executed. Is there a better, more standard way of handling the log-in / log-out procedure with multiple secured forms on the page?

Answer 1

I found the root of the issue. It was caused by some controller actions, for which:

• Either the [ValidateRenderingToken] attribute was missing;
• Or the [ValidateRenderingToken] attribute was added after the [ValidateAntiForgeryToken] attribute, thus changing the execution order.