title: ASP.NET MVC 3 web site anti-forgery token fails only on IE
body: <p>In my MVC 3 project i have a login page that uses the anti-forgery logic built into MVC 3.</p>
  
  <p>On Firefox &amp; Opera it works just fine, but on IE I get this:</p>
  
  <pre><code>A required anti-forgery token was not supplied or was invalid.
  </code></pre>
  
  <p>I'm really stumped on why only IE suffers this, I checked the cookie settings and they are set the same as the other browsers so I'm at a lost here.</p>
  
  <p>When I use the anti forgery code, I use both a SALT and the domain check (which shouldn't matter but worth telling).</p>
  
  <p>Here is the view code:</p>
  
  <pre><code>@model login.Models.LogOnModel
  
  @{
      ViewBag.Title = "Log On";
  }
  
  &lt;script src="@Url.Content("~/Scripts/jquery.validate.min.js")" type="text/javascript"&gt; &lt;/script&gt;
  &lt;script src="@Url.Content("~/Scripts/jquery.validate.unobtrusive.min.js")" type="text/javascript"&gt;&lt;/script&gt;
  
  &lt;script type="text/javascript"&gt;
  $(function () {
      //focus on form.
      $("#UserName").focus();
  });
  &lt;/script&gt;
  
   @using (Html.BeginForm("LogOn", "Account", FormMethod.Post, new { @class = "form login" })) {
  @Html.AntiForgeryToken("!@#Hq4(", ViewBag.AppDomain, "/")
  &lt;div id="box"&gt;
  &lt;h1&gt;Login&lt;/h1&gt;
  Please enter your username and password. @Html.ActionLink("Register", "Register") if you don't have an account.
  &lt;div class="block" id="block-login"&gt;
      &lt;h2&gt;
          Login Form&lt;/h2&gt;
      &lt;div class="content login"&gt;
                @Html.ValidationSummary(true)
          &lt;div class="group buffer"&gt;
              &lt;div class="left"&gt;
                  &lt;label class="label right"&gt;
                      @Html.LabelFor(m =&gt; m.UserName)&lt;/label&gt;
              &lt;/div&gt;
              &lt;div class="right"&gt;
                  @Html.TextBoxFor(m =&gt; m.UserName, new { @class = "text_field" })
                  @Html.ValidationMessageFor(m =&gt; m.UserName)
              &lt;/div&gt;
          &lt;/div&gt;
          &lt;div class="group buffer"&gt;
              &lt;div class="left"&gt;
                  &lt;label class="label right"&gt;
                      @Html.LabelFor(m =&gt; m.Password)&lt;/label&gt;
              &lt;/div&gt;
              &lt;div class="right"&gt;
                  @Html.PasswordFor(m =&gt; m.Password, new { @class = "text_field" })
                  @Html.ValidationMessageFor(m =&gt; m.Password)
              &lt;/div&gt;
          &lt;/div&gt;
          &lt;div class="group buffer"&gt;
              &lt;div class="left"&gt;
                  &lt;label class="label right"&gt;
                      @Html.LabelFor(m =&gt; m.RememberMe)&lt;/label&gt;
              &lt;/div&gt;
              &lt;div class="right"&gt;
                  @Html.CheckBoxFor(m =&gt; m.RememberMe)
              &lt;/div&gt;
          &lt;/div&gt;
          &lt;div class="group navform buffer"&gt;
              &lt;div class="right"&gt;
                  &lt;button class="button" type="submit"&gt;
                      &lt;img src="@Url.Content("~/Content/images/icons/key.png")" alt="Save" /&gt;
                      Login
                  &lt;/button&gt;
              &lt;/div&gt;
          &lt;/div&gt;
      &lt;/div&gt;
  &lt;/div&gt;
  &lt;/div&gt;
  }
  </code></pre>
  
  <p>ViewBag.AppDomain is a value from web.config for easy setting during testing and production usage.</p>
  
  <p>If I remove the domain and path portion from the antiforgery tag, it works just fine. So one of those two must be the problem.</p>