Anti-Forgery Token was meant for a different claims-based user

Question

I am working on a logout feature in the application we are using ASP.NET Identity login. I can login successfully but when I logout and then try to login again I get the following message:

The provided anti-forgery token was meant for a different claims-based user than the current user. 

Here is my logout code:

 public ActionResult Logout()         {             SignInManager.Logout();             return View("Index");          }  **SignInManager.cs**  public void Logout()         {             AuthenticationManager.SignOut();          } 

After the user press the logout button he is taken to the login screen. The url still says "http://localhost:8544/Login/Logout". Since we are on the login screen maybe it should just say "http://localhost:8544/Login".

Answer 1

What worked for me was switching the order of the middlewares used. Add first app.UseAuthentication() and then the antiforgery stuff. This is how I did it:

app.UseAuthentication(); app.Use(next => ctx =>         {             var tokens = antiforgery.GetAndStoreTokens(ctx);              ctx.Response.Cookies.Append("XSRF-TOKEN", tokens.RequestToken,                 new CookieOptions() { HttpOnly = false });              return next(ctx); }); 

Doing it the other way around creates a token that is not meant for authenticated users.