title: Troubleshooting anti-forgery token problems
body: <p>I have a form post that consistently gives me an anti-forgery token error.</p>
  
  <p>Here is my form:</p>
  
  <pre><code>@using (Html.BeginForm())
  {
      @Html.AntiForgeryToken()
      @Html.EditorFor(m =&gt; m.Email)
      @Html.EditorFor(m =&gt; m.Birthday)
      &lt;p&gt;
          &lt;input type="submit" id="Go" value="Go" /&gt;
      &lt;/p&gt;
  }
  </code></pre>
  
  <p>Here is my action method:</p>
  
  <pre><code>[HttpPost]
  [ValidateAntiForgeryToken]
  public ActionResult Join(JoinViewModel model)
  {
      //a bunch of stuff here but it doesn't matter because it's not making it here
  }
  </code></pre>
  
  <p>Here is the machineKey in web.config:</p>
  
  <pre><code>&lt;system.web&gt;
    &lt;machineKey validationKey="mykey" decryptionKey="myotherkey" validation="SHA1" decryption="AES" /&gt;
  &lt;/system.web&gt;
  </code></pre>
  
  <p>And here is the error I get:</p>
  
  <pre><code>A required anti-forgery token was not supplied or was invalid.
  </code></pre>
  
  <p>I've read that changing users on the HttpContext will invalidate the token, but this isn't happening here.  The HttpGet on my Join action just returns the view:</p>
  
  <pre><code>[HttpGet]
  public ActionResult Join()
  {
      return this.View();
  }
  </code></pre>
  
  <p>So I'm not sure what's going on.  I've searched around, and everything seems to suggest that it's either the machineKey changing (app cycles) or the user/session changing.</p>
  
  <p>What else could be going on? How can I troubleshoot this?</p>