title: Anti-forgery token issue in ASP.NET MVC integration with Angular JS
body: <p>Good day!</p>
  
  <p>I'm dealing with an issue for some time now and can't seem to find a solution. I have an usual ASP.NET MVC project on 'top' of which I added an Angular JS project. I also have a Web API, but this is not relevant for my issue. The web application itself is the Angular project, making calls to the API.</p>
  
  <p>I used the default authentication system from ASP.NET MVC using the default Login.cshtml View and default AcountController methods for login/logout.</p>
  
  <p>The problem I'm dealing with is the following:</p>
  
  <p>A user enters the website and is prompted with the login form. After inserting valid account details, he is redirected to the main page (index, from the angular js project). IF the user clicks on the Back button of the browser, he is prompted with login form again and if he inserts his user and password again (or any other sign-in details), I receive a <strong>HttpAntiForgeryException</strong> with the following message: "<strong>The provided anti-forgery token was meant for a different claims-based user than the current user.</strong>"</p>
  
  <p>I tried disabling the back button with javascript (window.history.forward(1);), but it doesn't work apparently on older browser versions and it's by far an elegant solution. I tried reloading the login page (because after clicking back, if you reload the page you will be redirected to the index page (since the session is still valid)) and none of these solutions really work.</p>
  
  <p>Any ideas?</p>
  
  <p>Thank you in advance!</p>
  
  <p><strong>Update:</strong> so far I've included <code>AntiForgeryConfig.SuppressIdentityHeuristicChecks = true;</code> in <code>Application_Start()</code> and also this:</p>
  
  <pre><code>public class HandleAntiForgeryError : ActionFilterAttribute, IExceptionFilter {
      #region IExceptionFilter Members
  
      public void OnException(ExceptionContext filterContext)
      {
          var exception = filterContext.Exception as HttpAntiForgeryException;
          if (exception != null)
          {
              var routeValues = new RouteValueDictionary();
              routeValues["controller"] = "Account";
              routeValues["action"] = "Login";
              filterContext.Result = new RedirectToRouteResult(routeValues);
              filterContext.ExceptionHandled = true;
          }
      }
  
      #endregion }
  
  [HandleAntiForgeryError]
   public async Task&lt;ActionResult&gt; Login(LoginViewModel model, string returnUrl)
      {
      }
  </code></pre>
  
  <p>The only issue left is when I click back and try to login with another user it fails. Meaning I remain logged in with the previous user. I expect this to be normal, but is there a way to change that (as in when I click back and enter other user's credentials, to get logged in with those new credentials (even though I'm already logged in)). </p>
  
  <p><strong>SOLVED</strong>: In my code I had the following line: </p>
  
  <pre><code>         if (User.Identity.IsAuthenticated)
          return RedirectToAction("Index", "App");
  </code></pre>
  
  <p>That is why after logging in with another user I was being redirected to index being logged in with the old credentials.</p>