{"action":"created","issue":{"url":"https://api.github.com/repos/aspnet/Antiforgery/issues/83","repository_url":"https://api.github.com/repos/aspnet/Antiforgery","labels_url":"https://api.github.com/repos/aspnet/Antiforgery/issues/83/labels{/name}","comments_url":"https://api.github.com/repos/aspnet/Antiforgery/issues/83/comments","events_url":"https://api.github.com/repos/aspnet/Antiforgery/issues/83/events","html_url":"https://github.com/aspnet/Antiforgery/issues/83","id":156747969,"number":83,"title":"Cookie header request example","user":{"login":"Basewq","id":1356956,"avatar_url":"https://avatars.githubusercontent.com/u/1356956?v=3","gravatar_id":"","url":"https://api.github.com/users/Basewq","html_url":"https://github.com/Basewq","followers_url":"https://api.github.com/users/Basewq/followers","following_url":"https://api.github.com/users/Basewq/following{/other_user}","gists_url":"https://api.github.com/users/Basewq/gists{/gist_id}","starred_url":"https://api.github.com/users/Basewq/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Basewq/subscriptions","organizations_url":"https://api.github.com/users/Basewq/orgs","repos_url":"https://api.github.com/users/Basewq/repos","events_url":"https://api.github.com/users/Basewq/events{/privacy}","received_events_url":"https://api.github.com/users/Basewq/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/aspnet/Antiforgery/labels/question","name":"question","color":"cc317c"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/aspnet/Antiforgery/milestones/8","html_url":"https://github.com/aspnet/Antiforgery/milestones/Discussions","labels_url":"https://api.github.com/repos/aspnet/Antiforgery/milestones/8/labels","id":1664899,"number":8,"title":"Discussions","description":null,"creator":{"login":"Eilon","id":202643,"avatar_url":"https://avatars.githubusercontent.com/u/202643?v=3","gravatar_id":"","url":"https://api.github.com/users/Eilon","html_url":"https://github.com/Eilon","followers_url":"https://api.github.com/users/Eilon/followers","following_url":"https://api.github.com/users/Eilon/following{/other_user}","gists_url":"https://api.github.com/users/Eilon/gists{/gist_id}","starred_url":"https://api.github.com/users/Eilon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Eilon/subscriptions","organizations_url":"https://api.github.com/users/Eilon/orgs","repos_url":"https://api.github.com/users/Eilon/repos","events_url":"https://api.github.com/users/Eilon/events{/privacy}","received_events_url":"https://api.github.com/users/Eilon/received_events","type":"User","site_admin":false},"open_issues":2,"closed_issues":1,"state":"open","created_at":"2016-03-24T23:03:11Z","updated_at":"2016-05-25T16:51:43Z","due_on":null,"closed_at":null},"comments":9,"created_at":"2016-05-25T13:16:29Z","updated_at":"2016-05-25T20:10:00Z","closed_at":null,"body":"I looked at the AntiforgerySample but I'm still confused how this works in an Angular SPA environment (where the majority of `[ValidateAntiforgeryToken]` is declared on the backend WebApi in my project).\r\nI have followed the same as the sample, but I will also note I have added Identity, which I think also adds the Antiforgery service for itself(?).\r\n\r\nI have done a login page and a logoff page, where the cshtmls are 'dumb' and I have HttpPost methods LogIn and LogOff `[ValidateAntiforgeryToken]` as WebApi methods that the angular controller calls.\r\nThe first time it generates the token and I can successfully log on in the Login page.\r\nHowever, any subsequent WebApi calls that have `[ValidateAntiforgeryToken]` (eg. my LogOff WebApi method), I keep getting `The provided antiforgery token was meant for a different claims-based user than the current user.`\r\nLooking at Fiddler, I see 3 cookie tokens sent on request (each with different values):\r\n`.AspNetCore.Antiforgery.xxxx`\r\n`.AspNetCore.Identity.Application`\r\n`XSRF-TOKEN`\r\n\r\nAm I missing something in my case? Do I need to override how the validation is working?"},"comment":{"url":"https://api.github.com/repos/aspnet/Antiforgery/issues/comments/221692064","html_url":"https://github.com/aspnet/Antiforgery/issues/83#issuecomment-221692064","issue_url":"https://api.github.com/repos/aspnet/Antiforgery/issues/83","id":221692064,"user":{"login":"HaoK","id":6537861,"avatar_url":"https://avatars.githubusercontent.com/u/6537861?v=3","gravatar_id":"","url":"https://api.github.com/users/HaoK","html_url":"https://github.com/HaoK","followers_url":"https://api.github.com/users/HaoK/followers","following_url":"https://api.github.com/users/HaoK/following{/other_user}","gists_url":"https://api.github.com/users/HaoK/gists{/gist_id}","starred_url":"https://api.github.com/users/HaoK/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/HaoK/subscriptions","organizations_url":"https://api.github.com/users/HaoK/orgs","repos_url":"https://api.github.com/users/HaoK/repos","events_url":"https://api.github.com/users/HaoK/events{/privacy}","received_events_url":"https://api.github.com/users/HaoK/received_events","type":"User","site_admin":false},"created_at":"2016-05-25T20:09:59Z","updated_at":"2016-05-25T20:09:59Z","body":"Have you tried turning on logging and seeing if any interesting failures come out? \r\nIn general if CookieValidatePrincipalContext has the authenticated user, and you successfully remove the Validation, it should flow through.\r\n\r\nIs AutomaticAuthenticate set to true for your cookies?\r\n"}}
{"actor":{"display_login":"HaoK"}}