title: ValidateAntiForgeryToken presenving cookie value for the session
body: <p>I am not sure whether this is a "feature" or a bug on the MVC framework. </p>
  
  <p>While implementing a few actions with the [ValidateAntiForgeryToken] attribute on them I've noticed that although on the view, the <strong>_<em>RequestVerificationToken</strong> hidden text field changes with every re-load of the page, the cookie <strong></em>_RequestVerificationToken_Lw__</strong> always remains the same for the length of the session, i.e. all views will use the same cookie value to compare against.</p>
  
  <p>From what I can gather, the value on the view is different because it gets encrypted every time but in reality, like the cookie, it's also the same as the cookie for the length of the session.</p>
  
  <p>My question is. Shouldn't we be able to force this cookie to have a different value for every different request? </p>
  
  <p>I would have thought that keeping the same cookie value for the length of the session is a security risk, as a malicious hacker could get hold of it and our CSRF (Cross Site Request Forgery) preventive measures would go out of the window.</p>
  
  <p>Is there a way of forcing this cookie to get a different value for each request?</p>