title: .net Core MVC: X-SRF-TOKEN not accepted, 400 returned
body: <p>I have a .net core app using angularJS, and I want to protect the api calls protected by our cookie based authentication. I Followed the steps in this article:</p>
  <p><a href="https://docs.microsoft.com/en-us/aspnet/core/security/anti-request-forgery" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/aspnet/core/security/anti-request-forgery</a></p>
  <ul>
  <li><p>I added the <code>services.AddAntiforgery(options =&gt; options.HeaderName = &quot;X-XSRF-TOKEN&quot;);</code> to my services configuration</p>
  </li>
  <li><p>I am seeing the <code>XSRF-TOKEN</code> cookie in my developer tools when loading the page.</p>
  </li>
  <li><p>I am seeing the <code>X-XSRF-TOKEN</code> header being added to my $http sent requests.</p>
  </li>
  <li><p>I have added the <code>[AutoValidateAntiforgeryToken]</code> to my controller that is handling the ajax request.</p>
  </li>
  <li><p>I have ssl enabled, and am accessing the pages via https.</p>
  </li>
  </ul>
  <p>I can make GET requests fine through this api endpoint as expected. However, I am receiving a 400 error without any details of why the request was bad on PUTs and POSTs.</p>
  <p>I know the <code>X-XSRF-TOKEN</code> is on the request,  (seen in the network tab of chrome dev tools) so I am unsure what I am missing to allow these requests to be received correctly.</p>
  <p><strong>TL;DR:</strong> Why is .net core rejecting my valid AntiforgeryToken?</p>
  <p><strong>UPDATE</strong> Attempted @joey's suggested solution, but it did not work, still receiving 400 responses. code below reflects another solution I tried to fix this problem (aka angularjs's solution to setting default cookies and headers for cross site scripting protection)</p>
  <p>I have also attempted to configure AngularJS to change what the cookie and header names match what I configured in my <code>Startup.cs</code>. I changed their names to try both <code>XSRF-TOKEN</code> (cookie) and <code>X-XSRF-TOKEN</code> (header) as well as <code>CSRF-TOKEN</code> and <code>X-CSRF-TOKEN</code>, and while the configurations within angular is correctly using the new default to what ever I provide, my authentication code in .net core is still not working.</p>
  <p>for more information here is how i am configuring AngularJS:</p>
  <pre><code>app.config(function ($httpProvider) {
      $httpProvider.defaults.xsrfHeaderName = 'X-CSRF-TOKEN';
      $httpProvider.defaults.xsrfCookieName = 'CSRF-TOKEN';
  });
  </code></pre>
  <p>here is the <code>ConfigureServices</code> line I have in my <code>Startup.cs</code> file:</p>
  <pre><code>services.AddAntiforgery(options =&gt; options.HeaderName = &quot;X-CSRF-TOKEN&quot;);
  </code></pre>
  <p>and lastly here is the code I added to the <code>Configure</code> method of the <code>Startup.cs</code> file:</p>
  <pre><code>    app.Use(next =&gt; context =&gt; 
      {
          string path = context.Request.Path.Value;
          if (path.Contains(&quot;/MyProtectedPath/&quot;))
          {
              var tokens = antiforgery.GetAndStoreTokens(context);
              context.Response.Cookies.Append(&quot;CSRF-TOKEN&quot;, tokens.RequestToken,
                  new CookieOptions { HttpOnly = false });
          }
          return next(context);
      });
  </code></pre>
  <p><strong>UPDATE 2:</strong>
  I have added the following to my controller action:</p>
  <pre><code>if (HttpContext.Request.Method.ToLower(CultureInfo.InvariantCulture) != &quot;get&quot;)
  {
      await _antiforgery.ValidateRequestAsync(HttpContext);
  }
  </code></pre>
  <p><code>AntiforgeryValidationException: The provided antiforgery token was meant for a different claims-based user than the current user.</code></p>
  <p>I thought maybe <code>antiforgery.GetAndStoreTokens(context)</code> might be overriding the current cookie sent on the page load, so I make it only hit that code on GET requests, but I get the same result for the posts.</p>
  <p><strong>Update 3</strong>
  Thanks @joey for your help, I have looked at my startup.cs file, and I have the UseAuthentication in a seperate branch:</p>
  <pre><code>    app.Use(next =&gt; context =&gt; //note: order of these use statements is key. keep this antiforgery section above auth!
      {
          string path = context.Request.Path.Value;
          if (path.ToLower(CultureInfo.InvariantCulture).Contains(&quot;/campaigns/proxy/&quot;))
          {
              var tokens = antiforgery.GetAndStoreTokens(context);
              context.Response.Cookies.Append(&quot;XSRF-TOKEN&quot;, tokens.RequestToken,
                  new CookieOptions { HttpOnly = false });
          }
          return next(context);
      });
  
      // Use Basic Auth for /api
      app.UseWhen(context =&gt; context.Request.Path.StartsWithSegments(new PathString(&quot;/api&quot;)), branch =&gt;
      {
          branch.UseBasicAuth();
      });
      // Use Identity for everything except /api
      app.UseWhen(context =&gt; !context.Request.Path.StartsWithSegments(new PathString(&quot;/api&quot;)), branch =&gt;
      {
  
          app.UseAuthentication(); // required for .net core 2.0 authentication
      });
  </code></pre>
  <p>I am not sure why my tokens would be considered invalid at this point...</p>