title: Web API Antiforgery Tokens are swapped
body: <p>My Web APIs are accessed by Angular client hosted in Node process and hence I am generating anti forgery tokens as part of OAuth token generation and attach them as cookies for the response as shown below:</p>
  
  <pre><code>public static void SetXsrfCookies(IOwinResponse response, DateTime expiresUtc)
      {
          string cookieToken;
          string formToken;
  
          AntiForgery.GetTokens("", out cookieToken, out formToken);
  
          response.Cookies.Append(AntiForgeryConfig.CookieName, cookieToken,
              new CookieOptions()
              {
                  HttpOnly = true /* we want JavaScript clients to read this cookie*/,
                  Expires = expiresUtc
              });
  
          response.Cookies.Append("FORM-TOKEN", formToken,
              new CookieOptions()
              {
                  HttpOnly = true /* we want JavaScript clients to read this cookie*/,
                  Expires = expiresUtc
              });
      }
  </code></pre>
  
  <p>I see cookies being received by the client.</p>
  
  <p>Then for subsequent calls, I include below headers:</p>
  
  <pre><code>Authorization: Bearer someOAuthToken
  Content-Type: application/json
  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36     (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36
  Cache-Control: no-cache
  __RequestVerificationToken: someCookieToken
  Accept: */*
  Accept-Encoding: gzip, deflate, br
  Accept-Language: en-US,en;q=0.8
  Cookie: Logout=true; __RequestVerificationToken=someFormToken
  </code></pre>
  
  <p>As can be noted, I am including both cookieToken and formToken in the headers.</p>
  
  <p>When client makes the call, I validate those tokens as shown below (this code is as per other SO people discussions):</p>
  
  <pre><code>var headers = actionContext.Request.Headers;
  var cookie = headers.GetCookies()
                      .Select(c =&gt; c[AntiForgeryConfig.CookieName])
                      .FirstOrDefault();
  var aspNetMvcRequestVerificationToken = headers.GetValues(AntiForgeryConfig.CookieName).FirstOrDefault();
  AntiForgery.Validate(cookie != null ? cookie.Value : null,  aspNetMvcRequestVerificationToken);
  </code></pre>
  
  <p>This method fails with the below error</p>
  
  <blockquote>
    <p>"Validation of the provided anti-forgery token failed. The cookie "__RequestVerificationToken" and the form field "__RequestVerificationToken" were swapped."</p>
  </blockquote>
  
  <p>After this, I have tried swapping but getting below error:</p>
  
  <blockquote>
    <p>"The provided anti-forgery token was meant for a different claims-based user than the current user."</p>
  </blockquote>
  
  <p>I have looked at few people reporting similar errors: <a href="https://stackoverflow.com/questions/27278553/provide-antiforgery-token-with-system-net-http-httpclient-and-mvc">link</a> but not sure about the solution. Can someone review the above code and let me know the error.</p>
  
  <p>Note: I have used Fiddler for testing purposes.</p>
  
  <p>Thanks</p>