title: Antiforgerytoken MVC C# search form
body: <p>I have a search box on my site. 
  The controller looks like this: </p>
  
  <pre><code>[HttpPost]
  [ValidateAntiForgeryToken]         
  public ActionResult SearchResults(SearchModel model)
  {
  </code></pre>
  
  <p>View:</p>
  
  <pre><code> &lt;div class="siteSearch clearfix" role="search"&gt;
  
          &lt;form id="HeaderSearchForm"&gt;
  
              @Html.AntiForgeryToken()
              &lt;label for="tbSiteSearch"&gt;Search:&lt;/label&gt;
  
              &lt;input type="text" id="tbSiteSearch" name="tbSiteSearch" class="text" /&gt;
              &lt;button type="submit" class="btn submit"&gt;
                  &lt;i class="icon-search"&gt;&lt;/i&gt;
              &lt;/button&gt;
          &lt;/form&gt;
  
      &lt;/div&gt; 
  </code></pre>
  
  <p>So when I do a search, I can see the hidden label with the Anti Forgery Token present. This all works as expected because if I take a blank html page, copy the form code and leave the '__RequestVerificationToken' blank, I get told that the token hasn't been set and the search doesn't run. Which is what I would expect. 
  The issue I have is if I submit a search, copy the token from my site and place it in to my blank html page e.g. </p>
  
  <pre><code> &lt;html&gt;
    &lt;body&gt;
    &lt;script&gt;history.pushState('', '', '/')&lt;/script&gt;
      &lt;form action="https://www.adomainname.co.uk/Search/SearchResults/" method="POST"&gt;
        &lt;input type="hidden" name="SearchTerm" value="testing" /&gt;
      &lt;input type="hidden" name="&amp;#95;&amp;#95;RequestVerificationToken" value="theverificationtokengoeshere" /&gt; 
        &lt;input type="submit" value="Submit request" /&gt;
      &lt;/form&gt;
    &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>The request is submitted - even if I am running the above code on localhost. I would have expected the form to not submit as it was coming from a different domain. Am I misunderstanding how this should work? </p>
  
  <p>If I refresh the page and resubmit Im obviously allocated a new AFT and so the submit fails again but this doesn't feel right. </p>
  
  <p>Ideally I would prefer the form action to only run on the domain it's on and not be able to execute the action from another site. I thought using AntiForgeryToken prevent Cross-Site Request Forgery. </p>
  
  <p>If any of this is unclear, please let me know and I'll explain more. </p>