{"action":"created","issue":{"url":"https://api.github.com/repos/aspnet/Home/issues/2882","repository_url":"https://api.github.com/repos/aspnet/Home","labels_url":"https://api.github.com/repos/aspnet/Home/issues/2882/labels{/name}","comments_url":"https://api.github.com/repos/aspnet/Home/issues/2882/comments","events_url":"https://api.github.com/repos/aspnet/Home/issues/2882/events","html_url":"https://github.com/aspnet/Home/issues/2882","id":297823619,"node_id":"MDU6SXNzdWUyOTc4MjM2MTk=","number":2882,"title":"Apparently Random Error: \"Antiforgery token validation failed. The antiforgery cookie token and request token do not match.\"","user":{"login":"wessleym","id":2538392,"node_id":"MDQ6VXNlcjI1MzgzOTI=","avatar_url":"https://avatars3.githubusercontent.com/u/2538392?v=4","gravatar_id":"","url":"https://api.github.com/users/wessleym","html_url":"https://github.com/wessleym","followers_url":"https://api.github.com/users/wessleym/followers","following_url":"https://api.github.com/users/wessleym/following{/other_user}","gists_url":"https://api.github.com/users/wessleym/gists{/gist_id}","starred_url":"https://api.github.com/users/wessleym/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wessleym/subscriptions","organizations_url":"https://api.github.com/users/wessleym/orgs","repos_url":"https://api.github.com/users/wessleym/repos","events_url":"https://api.github.com/users/wessleym/events{/privacy}","received_events_url":"https://api.github.com/users/wessleym/received_events","type":"User","site_admin":false},"labels":[{"id":792032401,"node_id":"MDU6TGFiZWw3OTIwMzI0MDE=","url":"https://api.github.com/repos/aspnet/Home/labels/investigate","name":"investigate","color":"bfe5bf","default":false},{"id":792347695,"node_id":"MDU6TGFiZWw3OTIzNDc2OTU=","url":"https://api.github.com/repos/aspnet/Home/labels/repo:Antiforgery","name":"repo:Antiforgery","color":"5319e7","default":false}],"state":"open","locked":false,"assignee":{"login":"javiercn","id":6995051,"node_id":"MDQ6VXNlcjY5OTUwNTE=","avatar_url":"https://avatars2.githubusercontent.com/u/6995051?v=4","gravatar_id":"","url":"https://api.github.com/users/javiercn","html_url":"https://github.com/javiercn","followers_url":"https://api.github.com/users/javiercn/followers","following_url":"https://api.github.com/users/javiercn/following{/other_user}","gists_url":"https://api.github.com/users/javiercn/gists{/gist_id}","starred_url":"https://api.github.com/users/javiercn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/javiercn/subscriptions","organizations_url":"https://api.github.com/users/javiercn/orgs","repos_url":"https://api.github.com/users/javiercn/repos","events_url":"https://api.github.com/users/javiercn/events{/privacy}","received_events_url":"https://api.github.com/users/javiercn/received_events","type":"User","site_admin":false},"assignees":[{"login":"javiercn","id":6995051,"node_id":"MDQ6VXNlcjY5OTUwNTE=","avatar_url":"https://avatars2.githubusercontent.com/u/6995051?v=4","gravatar_id":"","url":"https://api.github.com/users/javiercn","html_url":"https://github.com/javiercn","followers_url":"https://api.github.com/users/javiercn/followers","following_url":"https://api.github.com/users/javiercn/following{/other_user}","gists_url":"https://api.github.com/users/javiercn/gists{/gist_id}","starred_url":"https://api.github.com/users/javiercn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/javiercn/subscriptions","organizations_url":"https://api.github.com/users/javiercn/orgs","repos_url":"https://api.github.com/users/javiercn/repos","events_url":"https://api.github.com/users/javiercn/events{/privacy}","received_events_url":"https://api.github.com/users/javiercn/received_events","type":"User","site_admin":false}],"milestone":null,"comments":13,"created_at":"2018-02-16T15:32:51Z","updated_at":"2018-09-26T23:39:48Z","closed_at":null,"author_association":"NONE","body":"## Background ##\r\nI have a relatively new ASP.NET Core 2 site.  It's running on just one server (Windows Server 2012 R2, IIS 8.5), and I only restart the site once every few days when I upload an update.  About once a day, a user's request fails due to rejection by the anti-forgery system.  These are POST requests, and there's nothing particularly special about them.  I'm including the anti-forgery value in the POST request, and 99% of the time, POST requests work.  But when they don't, the stdout log says, \"Antiforgery token validation failed. The antiforgery cookie token and request token do not match.\"  I've already posted this question on Stack Overflow and the ASP.NET Core forums, and I haven't gotten any useful answers.\r\n\r\n## Errors ##\r\nI've included the relevant portions of the stdout log below.\r\n\r\n    info: Microsoft.AspNetCore.Hosting.Internal.WebHost[1]\r\n          Request starting HTTP/1.1 POST [domain redacted] application/x-www-form-urlencoded 234\r\n    info: Microsoft.AspNetCore.Mvc.ViewFeatures.Internal.ValidateAntiforgeryTokenAuthorizationFilter[1]\r\n          Antiforgery token validation failed. The antiforgery cookie token and request token do not match.\r\n    Microsoft.AspNetCore.Antiforgery.AntiforgeryValidationException: The antiforgery cookie token and request token do not match.\r\n       at Microsoft.AspNetCore.Antiforgery.Internal.DefaultAntiforgery.ValidateTokens(HttpContext httpContext, AntiforgeryTokenSet antiforgeryTokenSet)\r\n       at Microsoft.AspNetCore.Antiforgery.Internal.DefaultAntiforgery.<ValidateRequestAsync>d__9.MoveNext()\r\n    --- End of stack trace from previous location where exception was thrown ---\r\n       at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n       at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n       at Microsoft.AspNetCore.Mvc.ViewFeatures.Internal.ValidateAntiforgeryTokenAuthorizationFilter.<OnAuthorizationAsync>d__3.MoveNext()\r\n    info: Microsoft.AspNetCore.Mvc.RazorPages.Internal.PageActionInvoker[3]\r\n          Authorization failed for the request at filter 'Microsoft.AspNetCore.Mvc.ViewFeatures.Internal.AutoValidateAntiforgeryTokenAuthorizationFilter'.\r\n    info: Microsoft.AspNetCore.Mvc.StatusCodeResult[1]\r\n          Executing HttpStatusCodeResult, setting HTTP status code 400\r\n    info: Microsoft.AspNetCore.Mvc.RazorPages.Internal.PageActionInvoker[2]\r\n          Executed action /Index in 2.6224ms\r\n    warn: Microsoft.AspNetCore.Antiforgery.Internal.DefaultAntiforgery[1]\r\n          Antiforgery validation failed with message 'The antiforgery cookie token and request token do not match.'.\r\n\r\nFor requests that result in the above stdout output, `IAntiforgery.IsRequestValidAsync` agrees by returning false.  Notice the error message \"The antiforgery cookie token and request token do not match.\"  Here's a reduced example of a failed POST request and the associated cookie.\r\n\r\n`POST: __RequestVerificationToken=\r\nCfDJ8F9Fs4CqDFpLttT96eZw9WHjWfHO8Yawn35k4Yq3gDK5n1TDJDDiY5o86VQs1_qOVIYBydCizBU4knb7Jmq1-heGhwnMu2KmhUIiAd0xI7Sudv3GX-J0OI6wRfiPL4L1KRs2Pml8dbsDfwemewBqi18`\r\n\r\n`Cookie:  .AspNetCore.Antiforgery.ClRyCRmWApY=CfDJ8F9Fs4CqDFpLttT96eZw9WFtJht41WcNrmgshi2pFGwcxhr0_0hvINQc7Yl9Cbjhv-TiSNXeEctyKborLI49AcjHfWIgOmmKkbjOe7QMn8Z0WZtkQy5JcaBHKEGTu1p-La8JL8pZZqZy02Hrswpkh3I`\r\n\r\nI've also captured this data a few times after the request has failed with a 400 error (using some error handling middleware):\r\n\r\n    AntiforgeryTokenSet tokens = antiforgery.GetTokens(context);\r\n    tokens.CookieToken:  null\r\n    tokens.FormFieldName:  \"__RequestVerificationToken\"\r\n    tokens.HeaderName:  \"RequestVerificationToken\"\r\n    tokens.RequestToken:  \"CfDJ8F9Fs4CqDFpLttT96eZw9WH33jSw5mM8h7RpEd3vGISQTRkx1rfwm-L2lfkvXKMBc-riESmoTo_fnIjeBbRmOo5KuJHr09f8B75sQ9g_djIVeeaGwMw5KE6W1O2-7Vi03fCnwlTv8l-BWGst76Ln-ZQ\"\r\n\r\nSo here are the three strings in the same order as listed above:\r\n\r\n    CfDJ8F9Fs4CqDFpLttT96eZw9WHjWfHO8Yawn35k4Yq3gDK5n1TDJDDiY5o86VQs1_qOVIYBydCizBU4knb7Jmq1-heGhwnMu2KmhUIiAd0xI7Sudv3GX-J0OI6wRfiPL4L1KRs2Pml8dbsDfwemewBqi18\r\n    CfDJ8F9Fs4CqDFpLttT96eZw9WFtJht41WcNrmgshi2pFGwcxhr0_0hvINQc7Yl9Cbjhv-TiSNXeEctyKborLI49AcjHfWIgOmmKkbjOe7QMn8Z0WZtkQy5JcaBHKEGTu1p-La8JL8pZZqZy02Hrswpkh3I\r\n    CfDJ8F9Fs4CqDFpLttT96eZw9WH33jSw5mM8h7RpEd3vGISQTRkx1rfwm-L2lfkvXKMBc-riESmoTo_fnIjeBbRmOo5KuJHr09f8B75sQ9g_djIVeeaGwMw5KE6W1O2-7Vi03fCnwlTv8l-BWGst76Ln-ZQ\r\n\r\nThe POST string and cookie string don't match, but in my experience, even with requests ASP.NET Core considers legitimate, they never do.  But strangely, the POST string and `tokens.RequestToken` doesn't match either.    I would think they should match, although I captured `tokens.RequestTooken` later in the request lifecycle, so maybe that has something to do with it.\r\n\r\n## ASP.NET Core 2 on GitHub ##\r\nI decided to look at the source code of ASP.NET Core 2.  I found this file, especially line 145:\r\n\r\nhttps://github.com/aspnet/Antiforgery/blob/dev/src/Microsoft.AspNetCore.Antiforgery/Internal/DefaultAntiforgeryTokenGenerator.cs\r\n\r\nThat line gets the message \"The antiforgery cookie token and request token do not match.\" from this file at line 134:\r\n\r\nhttps://github.com/aspnet/Antiforgery/blob/dev/src/Microsoft.AspNetCore.Antiforgery/Resources.resx\r\n\r\nSo I think that's where the message is originating, but I'm still left wondering why this is happening.\r\n\r\n## Question ##\r\nWould someone please help me figure out why these anti-forgery tokens aren't validating?  Is it possible the user's Web browser is mangling the cookie or POST data?  Does anyone have experience in this area or any suggestions?  Thank you."},"comment":{"url":"https://api.github.com/repos/aspnet/Home/issues/comments/424905390","html_url":"https://github.com/aspnet/Home/issues/2882#issuecomment-424905390","issue_url":"https://api.github.com/repos/aspnet/Home/issues/2882","id":424905390,"node_id":"MDEyOklzc3VlQ29tbWVudDQyNDkwNTM5MA==","user":{"login":"wessleym","id":2538392,"node_id":"MDQ6VXNlcjI1MzgzOTI=","avatar_url":"https://avatars3.githubusercontent.com/u/2538392?v=4","gravatar_id":"","url":"https://api.github.com/users/wessleym","html_url":"https://github.com/wessleym","followers_url":"https://api.github.com/users/wessleym/followers","following_url":"https://api.github.com/users/wessleym/following{/other_user}","gists_url":"https://api.github.com/users/wessleym/gists{/gist_id}","starred_url":"https://api.github.com/users/wessleym/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wessleym/subscriptions","organizations_url":"https://api.github.com/users/wessleym/orgs","repos_url":"https://api.github.com/users/wessleym/repos","events_url":"https://api.github.com/users/wessleym/events{/privacy}","received_events_url":"https://api.github.com/users/wessleym/received_events","type":"User","site_admin":false},"created_at":"2018-09-26T23:39:48Z","updated_at":"2018-09-26T23:39:48Z","author_association":"NONE","body":"@javiercn, right.  But why would a user signing into my site change the request validation cookie?  Why would signing in _specifically_ cause such an issue?  Would submitting any POST form cause this problem?"}}
{"actor":{"display_login":"wessleym"}}