9

For all my site pages, after being logged in for a few minutes, i get the following error when I attempt to log out:

The anti-forgery cookie token and form field token do not match.

I read in this link about ways to track this exception down, but since this exception only appears on logout, I wonder if it might just be easier exclude the anti-forgery-token for the logout form altogether. Is that a good idea?

I am using the template login page that is auto-generated with new MVC projects.

Thanks!

Community
  • 1
  • 1
Tormod Haugene
  • 3,538
  • 2
  • 29
  • 47

1 Answers1

9

It is advisable to add the token to a logout form, otherwise someone can create a page that posts to your logout page, logging out your users, which is annoying.

CodeCaster
  • 147,647
  • 23
  • 218
  • 272