title: runtime loading of ValidateAntiForgeryToken Salt value
body: <p>Consider an ASP.NET MVC application using the <code>Salt</code> parameter in the <code>[ValidateAntiForgeryToken]</code> directive.</p>
  
  <p>The scenario is such that the app will be used by many customers. It's not terribly desirable to have the <code>Salt</code> known at compile time. </p>
  
  <p>The current strategy is to locate the Salt value in the web.config.</p>
  
  <pre><code>[ValidateAntiForgeryToken(Salt = Config.AppSalt)]
  //Config.AppSalt is a static property that reads the web.config.
  </code></pre>
  
  <p>This leads to a compile-time exception suggesting that the <code>Salt</code> must be a const at compile time.</p>
  
  <blockquote>
    <p>An attribute argument must be a constant expression, typeof expression or array creation expression of an attribute parameter type</p>
  </blockquote>
  
  <p>How can I modify the application to allow for a runtime loading of the <code>Salt</code> so that the app doesn't have to be re-salted and recompiled for each customer?</p>
  
  <p>Consider that the <code>Salt</code> won't change frequently, if at all, thereby removing the possibility of invalidating form</p>