antiforgery

Jun 8, 2012 at 4:55 AM

hi, i got the antiforgery-error when executing post methods. i can't find out why... after Initial configuration it works. then after a restart of the pc i got this antiforgery error...

Jun 14, 2012 at 10:48 AM

Any more details would be highly appreciated

Coordinator
Jun 14, 2012 at 10:49 AM

Never ran into this problem, sorry.

Jul 12, 2012 at 4:26 PM

I'm having this problem as well. I downloaded the IdSrv source code, upgraded the EF assembly to 4.4, built it, and deployed it. I didn't change any code or anything in IdSrv; it's just that our custom membership/role/profile providers are using EF 4.4, so we needed to upgrade the version that IdSrv was using as well (same folder). Initial setup went fine, but now when I try to log in from my RP - or even just change any settings on the IdSrv itself - I get "A required anti-forgery token was not supplied or was invalid." I'm happy to provide more details if you can direct me where to look. :)

Coordinator
Jul 13, 2012 at 6:38 AM

I'll have a look. thanks!

Jul 13, 2012 at 3:48 PM

Another piece that might help:  We are using Visual Studio 2012 RC to build our code, including the IdSrv source. The code is still targeting .NET 4.0, but perhaps the new environment might have something to do with it. We have both .NET 4.0 and .NET 4.5 RC installed on the server where it's deployed.

Jul 13, 2012 at 7:15 PM

Wait, I think we figured it out.

Initially, we simply downloaded the IdSrv binaries and deployed them as-is. Then when we realized we had a conflicting version of the EF4 dll, we went back and downloaded the source, compiled it ourselves, and re-deployed - but just the binaries.

Apparently the CSHTML files that come with the binary download do not contain AntiForgery tokens; but they do in the source download. So the old CSHTML was not putting a token in the form, but the new compiled code was expecting to find one on form post. Once we overwrote all the files on our server with the files from the source download, it worked fine.

From the way the downloads are structured, we assumed the difference between version 1.0 and 1.0.1 was simply the addition of the Azure configuration. But it looks like there are some actual code changes in there as well. Perhaps an option to download the 1.0.1 binaries would make that more clear? At any rate, thanks so much for your help! This is a great application, and I look forward to using it!