title: AngularJS with XSRF-TOKEN from ASP.Net returns 400
body: <p>I have a very strange problem trying to implement XSRF in ASP.Net Core on angular $http post calls.</p>
  
  <p>POST Register is working correctly and has the following signature:</p>
  
  <pre><code>[HttpPost("Register")]
  [ValidateAntiForgeryToken]
  public async Task&lt;IActionResult&gt; PostRegister([FromBody]AccountRegisterPostRequest req)
  </code></pre>
  
  <p>However POST Logout returns 400 with the same signature:</p>
  
  <pre><code>[HttpPost("Logout")]
  [ValidateAntiForgeryToken]
  public async Task&lt;IActionResult&gt; PostLogout()
  {
     return Ok();
  }
  </code></pre>
  
  <p>ConfigureServices:</p>
  
  <pre><code>services.AddAntiforgery(options =&gt; options.HeaderName = "X-XSRF-TOKEN");
  services.AddMvc();
  services.Configure&lt;MvcOptions&gt;(c =&gt; c.Filters.Add(new RequireHttpsAttribute()));
  </code></pre>
  
  <p>Configure:</p>
  
  <pre><code>app.Use(next =&gt; context =&gt;
  {
     if (string.Equals(context.Request.Path.Value, "/", StringComparison.OrdinalIgnoreCase))
     {
        var tokens = antiforgery.GetAndStoreTokens(context);
        context.Response.Cookies.Append("XSRF-TOKEN", tokens.RequestToken,
           new CookieOptions() { HttpOnly = false });
     }
  
     return next(context);
  });
  
  app.UseStaticFiles();
  </code></pre>
  
  <p>The angular call looks like this:</p>
  
  <pre><code>$http.post("/api/Account/Logout")
  .then(function (result) {
     console.log(result);
  })
  </code></pre>
  
  <p>The API is in a seperate project in same solution.
  Help :)</p>