title: AntiForgeryToken re-use
body: <p>I have a MVC4 site that uses AntiForgeryTokens and always HTTPS. As I understand it, anti-forgery tokens can be reused as long as the user session is the same.</p>
  
  <p>I'm worried about some kind of attack where someone fetches the token somehow and reuses it to submit a form without the user's knowledge.</p>
  
  <p>Is there any real risk of attack with this setup? Do I need to consider some way of preventing token re-use?</p>