title: The provided antiforgery token was meant for a different claims-based user than the current user
body: <p>I'm rolling my own auth system and only using the bits that I need. My solution is based on <a href="https://github.com/leastprivilege/AspNetCoreSecuritySamples" rel="nofollow noreferrer">this github repo</a>. I've reviewed similar questions, but they don't seem to fit my situation. I also read <a href="https://stormpath.com/blog/token-authentication-asp-net-core" rel="nofollow noreferrer">this post about Authentication and JWT</a>, but I'm not sure if that's relevant or not either. I'm lost.</p>
  
  <p>My Startup.cs:</p>
  
  <pre><code>app.UseCookieAuthentication(new CookieAuthenticationOptions
          {
              AuthenticationScheme = "Cookies",
              AutomaticAuthenticate = true,
              AutomaticChallenge = true,
              LoginPath = new PathString("/auth/login")
          });
  
          app.UseClaimsTransformation(context =&gt;
          {
              if (context.Principal.Identity.IsAuthenticated)
              {
                  context.Principal.Identities.First().AddClaim(new Claim("now", DateTime.Now.ToString()));
              }
  
              return Task.FromResult(context.Principal);
          });
  </code></pre>
  
  <p>My Auth Controller works as expected. Here is my login action which uses [ValidateAntiForgeryToken]; however, the entire Controller is set to [AllowAnonymous]:</p>
  
  <pre><code>    [HttpPost]
      [ValidateAntiForgeryToken]
      public async Task&lt;IActionResult&gt; Login(LoginViewModel viewModel, string returnUrl = null)
      {
          ViewData["ReturnUrl"] = returnUrl;
  
          if (ModelState.IsValid)
          {
              var result = await _userManager.LoginUserAsync(viewModel.UserName, viewModel.Password, viewModel.RememberMe);
              if (result.Success)
              {
                  // TODO: Log successful login
  
                  var claims = new List&lt;Claim&gt;
                  {
                      new Claim(ClaimTypes.Name, result.User.FullName),
                      new Claim(ClaimTypes.Email, result.User.Email)
                  };
  
                  foreach(var role in result.User.Roles)
                  {
                      claims.Add(new Claim(ClaimTypes.Role, role.Name));
                  }
  
                  var identity = new ClaimsIdentity(claims, "password");
                  var principal = new ClaimsPrincipal(identity);
  
                  await HttpContext.Authentication.SignInAsync("Cookies", principal);
  
                  return LocalRedirect(returnUrl);
              }
              else
              {
                  AddModelErrors(result);
                  return View(viewModel);
              }
          }
  
          // Doh!
          return View(viewModel);
      }
  </code></pre>
  
  <p>So far, so good.</p>
  
  <p>Here's where I get the error (400 Bad Request). in the Create (Post) method:</p>
  
  <pre><code>[Authorize(Roles = "Admin")]
  public class UserAdministrationController : Controller
  {
      private readonly IUserManager _userManager;
      private readonly IUserAdminViewModelFactory _userAdminViewModelFactory;
  
      public UserAdministrationController(
          IUserManager userManager,
          IUserAdminViewModelFactory userAdminViewModelFactory
          )
      {
          _userManager = userManager ?? throw new ArgumentNullException(nameof(userManager));
          _userAdminViewModelFactory = userAdminViewModelFactory ?? throw new ArgumentNullException(nameof(userAdminViewModelFactory));
      }
  
  
      [HttpGet]
      public IActionResult Index()
      {
          var userViewModels = _userAdminViewModelFactory.CreateUserViewModelList();
          return View(userViewModels);
      }
  
      [HttpGet]
      public IActionResult Create()
      {
          var createUserViewModel = _userAdminViewModelFactory.CreateUserViewModel();
          return View(createUserViewModel);
      }
  
      [HttpPost]
      [ValidateAntiForgeryToken]
      public IActionResult Create(CreateUserViewModel viewModel)
      {
          return View();
      }
  }
  </code></pre>
  
  <p>Actually, the method never fires due to this error:</p>
  
  <blockquote>
    <p>Microsoft.AspNetCore.Antiforgery.AntiforgeryValidationException: The<br>
    provided antiforgery token was meant for a different claims-based user
    than the current user.
           at Microsoft.AspNetCore.Antiforgery.Internal.DefaultAntiforgery.ValidateTokens(HttpContext
    httpContext, AntiforgeryTokenSet antiforgeryTokenSet)
           at Microsoft.AspNetCore.Antiforgery.Internal.DefaultAntiforgery.d__9.MoveNext()</p>
  </blockquote>
  
  <p>I don't receive the error if I remove the [ValidateAntiForgeryToken]; however, I still receive the error if I remove the [Authorize(Roles = "Admin")] attribute.</p>
  
  <p>I imagine I've "messed up some mundane detail" or something, but not sure where.</p>