title: Validity of Anti-request forgery token in Asp.net MVC
body: <p>I have MVC application, during the pen test of the application, The Pen test team highlighted that <code>__RequestVerificationToken</code> value can be reused (i.e., they can issue POST request using a <code>__RequestVerificationToken</code> value which was generated for the previous request of the page or during the previous login session of the same user)</p>
  
  <p>Is there any configuration where we can control the validity of the <code>__RequestVerificationToken</code> value being generated?</p>
  
  <p>cshtml</p>
  
  <pre><code>@using (Html.BeginForm("Register", "User", FormMethod.Post, role = "form", novalidate = "false"
  {
      @Html.AntiForgeryToken()
      ///// some more code
  }
  </code></pre>
  
  <p>Controller</p>
  
  <pre><code>[HttpPost]
  [ValidateAntiForgeryToken]
  public ActionResult Register(parameter)
  {
      //// some code 
  }
  </code></pre>