title: ASP.net MVC cross application POST request
body: <p>I have several ASP.net MVC applications deployed on a single site in IIS. All of the applications are using forms authentication, and all of the applications are configured to use the same machine key. </p>
  
  <p>One of the applications is a 'base site' which provides navigation to the other applications and is where login/logout functionality is being handled. As it stands, a user can log in on the base site and visit the other applications and they will still be authenticated, which is working as intended. </p>
  
  <p>I have a logout form in the header of my shared layout views which submits a post request to the logout action in a controller belonging to the base site. When I submit this form from the base site, the logout works as expected. But if I try to submit the form from any of the other sites, I receive the error message:</p>
  
  <pre><code>"The anti-forgery cookie token and form field token do not match."
  </code></pre>
  
  <p>This is what my log off action looks like in my Security controller:</p>
  
  <pre><code>    [HttpPost]
      [ValidateAntiForgeryToken]
      public ActionResult LogOff()
      {
          FormsAuthentication.SignOut();
  
          return Redirect("~/");
      } 
  </code></pre>
  
  <p>This is what my form looks like in the base site view:</p>
  
  <pre><code>using (Html.BeginForm("LogOff", "Security", FormMethod.Post, null))
                  {
                      @Html.AntiForgeryToken()
                      &lt;input type="submit"  value="Log Off"/&gt;
                  }
  </code></pre>
  
  <p>Because of the way the directories are set up the other sites use a slightly different version of the same form to call the logout action from the base site:</p>
  
  <pre><code>using (Html.BeginForm("LogOff", "../Security", FormMethod.Post, null))
                  {
                      @Html.AntiForgeryToken()
                      &lt;input type="submit"  value="Log Off"/&gt;
                  } 
  </code></pre>
  
  <p>The base site is at the root of the directory, and the other applications are contained in their own folder within that root.</p>
  
  <p>None of the views I have tried this on have any conflicting forms or antiforgery tokens, and the machine key among all the apps seems to be configured properly or else I don't think the authentication would be working at all. I am considering just redirecting to the base site and performing the logout action from there, but if there is another more simple solution that I have yet to come across that would be nice.</p>