I can't get why during validation MVC takes into account not only form field but also a cookie with the same information. Looked through different SO answers and blogs but couldn't find the answer.
For instance, victim can transfer money on a http://bank.com using his authentication cookie.
Then an attacker send an email to a victim with such an image <img src="http://bank.example.com/withdraw?account=Alice&amount=1000000&for=Mallory">
. Why just not to prevent the malicious request by comparing only the form field "__RequestVerificationToken"
with some hash? Using the cookie seems to me a bit extra-stuff. Could you provide some scenario which "break" my hunch?