Question

We have an app written in ASP.NET MVC 3, that uses @Html.AntiForgeryToken().

We want to validate the token in our custom attribute (without a need of specifying the default attribute [ValidateAntiForgeryToken]). This should be pretty straightforward, but I’ve found an interesting inconsistency.

1. All the code below is running within the following method:

   [AttributeUsage(AttributeTargets.Method | AttributeTargets.Class, AllowMultiple = false, Inherited = true)]
   public class ValidateJsonAntiForgeryTokenAttribute : FilterAttribute, IAuthorizationFilter
   {  
       public void OnAuthorization(AuthorizationContext filterContext)
       {
       ...
   

2. AntiForgeryConfig.CookieName value is __RequestVerificationToken. That seems to make sense.

3. filterContext.HttpContext.Request.Cookies contains 1 cookie – but its name is __RequestVerificationToken_Lw__.

Question: aren’t those two supposed to be the same so I can use following snippet to get the cookie?

var cookie = filterContext.HttpContext.Request.Cookies[AntiForgeryConfig.CookieName];

Answer 1

The default cookie name changed between MVC 3 and MVC 4. In MVC 3, the default cookie name contains “Lw” and extra underscores near the end. Can you confirm that the cookie is being generated by an MVC 4 application instead of an MVC 3 application?