79318596

Date: 2024-12-30 20:57:20
Score: 2
Natty:
Report link

Check out the capabilities of the AntiForgery tokens available in MVC.

https://learn.microsoft.com/en-us/aspnet/mvc/overview/security/xsrfcsrf-prevention-in-aspnet-mvc-and-web-pages#validating-the-tokens

You should be able to use the IAntiForgeryAdditionalDataProvider to tie some specific detail(s) in the anti forgery cookie to details in your auth cookie (maybe the Description property?). Then, you can handle the validation failure by clearing all auth data and redirecting to login like you would with any other auth timeout.

Reasons:
  • No code block (0.5):
  • Contains question mark (0.5):
  • Low reputation (1):
Posted by: Alex Livingston