title: ASP.NET MVC - ValidateAntiForgeryToken expiring
body: <p>In a web page we provide a hyperlink (GET) that the User may click on to authenticate:</p>
  
  <pre><code>@Html.ActionLink("Please Login", "MyMethod", "MyController")
  </code></pre>
  
  <p>This maps to the following controller method which returns a View:</p>
  
  <pre><code>    [RequireHttps]
      public ActionResult MyMethod()
      {
          return this.View(new MyModel());
      }
  </code></pre>
  
  <p>This View contains the Form in which the User supplies their credentials; the Form contains the required AntiForgeryToken.</p>
  
  <p>When the User submits the form, the following Controller method is called:</p>
  
  <pre><code>    [HttpPost]
      [RequireHttps]
      [ValidateAntiForgeryToken]
      public ActionResult MyMethod(MyModel model)
      {
          // my logic
      }
  </code></pre>
  
  <p>This works perfectly well, most of the time...</p>
  
  <p>However, if the User leaves their browser open for a "significant" period of time and then performs the following steps in quick succession:</p>
  
  <ol>
  <li>Clicks on the hyperlink (GET) to load the log-in form</li>
  <li>Completes the form and submits</li>
  </ol>
  
  <p>They get an exception informing them that the Anti-Forgery token was either not provided or was invalid.</p>
  
  <p>I don't understand why this is the case: the View (containing the form) is created after the browser was dormant and so the anti-forgery tokens should all be "fresh".  However, something is evidently wrong with this design, but I'm not sure how best to rectify it.</p>
  
  <p>Thanks in advance if you have any suggestions.</p>
  
  <p>Griff</p>