title: Where exactly to put the antiforgeryToken
body: <p>I have a layout page that has a form with AntiForgeryToken</p>
  
  <pre><code>using (Html.BeginForm(action, "Account", new { ReturnUrl = returnUrl }, FormMethod.Post, new { Id = "xcrf-form" }))
  </code></pre>
  
  <p>This generates a hidden field</p>
  
  <pre><code>&lt;input name="__RequestVerificationToken" type="hidden" value="p43bTJU6xjctQ-ETI7T0e_0lJX4UsbTz_IUjQjWddsu29Nx_UE5rcdOONiDhFcdjan88ngBe5_ZQbHTBieB2vVXgNJGNmfQpOm5ATPbifYE1"&gt;
  </code></pre>
  
  <p>In my angular view (that is loaded in a div in the layout page, I do this</p>
  
  <pre><code>&lt;form class="form" role="form" ng-submit="postReview()"&gt;
  </code></pre>
  
  <p>And my code for postReview() is as follows</p>
  
  <pre><code>$scope.postReview = function () {
      var token = $('[name=__RequestVerificationToken]').val();
  
      var config = {
          headers: {
              "Content-Type": "multipart/form-data",
              // the following when uncommented does not work either
              //'RequestVerificationToken' : token
              //"X-XSRF-TOKEN" : token
          }
      }
  
      // tried the following, since my other MVC controllers (non-angular) send the token as part of form data, this did not work though
      $scope.reviewModel.__RequestVerificationToken = token;
  
      // the following was mentioned in some link I found, this does not work either
      $http.defaults.headers.common['__RequestVerificationToken'] = token;
  
      $http.post('/Review/Create', $scope.reviewModel, config)
      .then(function (result) {
          // Success
          alert(result.data);
      }, function (error) {
          // Failure
          alert("Failed");
      });
  }
  </code></pre>
  
  <p>My MVC Create method is as follows</p>
  
  <pre><code>    [HttpPost]
      [ValidateAntiForgeryToken]
      [AllowAnonymous]
      public ActionResult Create([Bind(Include = "Id,CommentText,Vote")] ReviewModel reviewModel)
      {
          if (User.Identity.IsAuthenticated == false)
          {
              // I am doing this instead of [Authorize] because I dont want 302, which browser handles and I cant do client re-direction
              return new HttpStatusCodeResult(HttpStatusCode.Forbidden);
          }
  
          // just for experimenting I have not yet added it to db, and simply returning
          return new JsonResult {Data = reviewModel, JsonRequestBehavior = JsonRequestBehavior.AllowGet};
      }
  </code></pre>
  
  <p>So no matter where I put the token, no matter what I use for 'Content-Type' (I tried application-json and www-form-urlencoded) I always get the error "The required anti-forgery form field &quot;__RequestVerificationToken&quot; is not present."</p>
  
  <p>I even tried naming __RequestVerificationToken and RequestVerificationToken</p>
  
  <p>Why does my server not find the damn token?</p>
  
  <p>I also looked at couple of links that ask you to implement your own AntiForgeryToeknVerifyAttrbute and verify the token that is sent as cookieToken:formToken, I have not tried that but why I am not able to get it working whereas this works for the MVC controllers (non-angular posts)</p>