.net - The anti-forgery cookie token and form field token do not match - Orchard 1.8.1 -
i use @html.antiforgerytokenorchard() method render token. error when submiting form. site on azure web. when use original site name xxxx.azurewebsites.net token works. only, when use mapped domain name error. error regardless of browser, if force updating site (ctrl+f5) , post form, token works. if open new incognito browser window fails again new session.
i have machine key configured in web.config.
please, me rid of annoying bug. appreciated. thanks.
you can't have both anti-forgery , caching, on same form, because anti-forgery token not reusable , part of response. consequence, need choose between them. form has information shouldn't possible forge (and that's form) should have anti-forgery on. default solution should disable caching, using [outputcache]
attribute on controller action renders form. if prefer caching on anti-forgery, anti-forgery can turned off action action, using [validateantiforgerytokenorchard]
attribute on action target of form. again, disabling caching should preferred.
Comments
Post a Comment