title: Provide AntiForgery Token with System.Net.Http.HttpClient and MVC
body: <p>I have a WPF (could be any winform I guess) app that tries to login to a standard MVC 5 website using a <strong>HttpClient</strong>.</p>
  
  <blockquote>
    <p>Normally I can login successfully with a call to <strong>PostAsync()</strong> where I provide the UserName and Password params in a <strong>HttpContent</strong>!</p>
  </blockquote>
  
  <p>However, when I add the <strong>[ValidateAntiForgeryToken]</strong> to my controller's Login (POST) action, the PostAsync() call fails with Internal Server Error.</p>
  
  <p>I have tried collecting the "__RequestVerificationToken" from a simple GET request and sending it with my POST request by adding it to the POST params, the Header of the request or the HttpHandler's <strong>CookieContainer</strong> (or any combination of the three) but still I get error 500 from the server.</p>
  
  <p>I know it can be done with HttpWebRequests (<a href="https://stackoverflow.com/questions/14467804/handle-antiforgery-token-in-winform-and-webapi">apparently</a>) but I don't know what I'm missing when using a HttpClient. I also don't know what exactly went wrong on the server side.. or how to check that since the code never reaches my controller method.</p>
  
  <p>Did someone else try this by any chance?</p>
  
  <p><strong>EDIT 1</strong>:</p>
  
  <p>I'm adding the raw data sent by the <strong>browser</strong> for both GET and POST:</p>
  
  <pre><code>GET http://localhost:57457/Account/Login HTTP/1.1
  Accept: text/html, application/xhtml+xml, */*
  Referer: http://localhost:57457/Account/Login
  Accept-Language: en-US
  User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
  Accept-Encoding: gzip, deflate
  Connection: Keep-Alive
  DNT: 1
  Host: localhost:57457
  Cookie: NavigationTreeViewState=%5b%7b%27N0_1%27%3a%27T%27%2c%27N0%27%3a%27T%27%7d%2c%27N0_1_2%27%2c%7b%7d%5d; style=default; __RequestVerificationToken=Bak42Ga5sHJitYlmut6OgvmqXNmP7kKQRNaMSsLMAUh86iHGGmz5pnNfz_soKu46Wax9sG23arPOTnSh1bvaWyWqQ9NH4GJxFmendW8VFTg1
  
  RESPONSE:
  HTTP/1.1 200 OK
  Cache-Control: private
  Content-Type: text/html; charset=utf-8
  Content-Encoding: gzip
  Vary: Accept-Encoding
  Server: Microsoft-IIS/8.0
  X-AspNetMvc-Version: 5.2
  X-Frame-Options: SAMEORIGIN
  X-AspNet-Version: 4.0.30319
  X-SourceFiles: =?UTF-8?B?RDpcRUJTLkNvZGVcUHJvamVjdHNcQ1ZSUE9TX1dlYlNpdGVcQ1ZSUE9TX1dlYlNpdGVcQWNjb3VudFxMb2dpbg==?=
  X-Powered-By: ASP.NET
  Date: Thu, 04 Dec 2014 10:00:00 GMT
  Content-Length: 1734
  [View page content]
  </code></pre>
  
  <hr>
  
  <pre><code>POST http://localhost:57457/Account/Login HTTP/1.1
  Accept: text/html, application/xhtml+xml, */*
  Referer: http://localhost:57457/Account/Login
  Accept-Language: en-US
  User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
  Content-Type: application/x-www-form-urlencoded
  Accept-Encoding: gzip, deflate
  Connection: Keep-Alive
  Content-Length: 180
  DNT: 1
  Host: localhost:57457
  Pragma: no-cache
  Cookie: NavigationTreeViewState=%5b%7b%27N0_1%27%3a%27T%27%2c%27N0%27%3a%27T%27%7d%2c%27N0_1_2%27%2c%7b%7d%5d; style=default; __RequestVerificationToken=Bak42Ga5sHJitYlmut6OgvmqXNmP7kKQRNaMSsLMAUh86iHGGmz5pnNfz_soKu46Wax9sG23arPOTnSh1bvaWyWqQ9NH4GJxFmendW8VFTg1
  
  __RequestVerificationToken=Bak42Ga5sHJitYlmut6OgvmqXNmP7kKQRNaMSsLMAUh86iHGGmz5pnNfz_soKu46Wax9sG23arPOTnSh1bvaWyWqQ9NH4GJxFmendW8VFTg1&amp;UserName=test&amp;Password=test
  
  RESPONSE:
  HTTP/1.1 400 Bad request (user/password for testing purposes only)
  Cache-Control: private
  Content-Type: text/html; charset=utf-8
  Server: Microsoft-IIS/8.0
  X-AspNetMvc-Version: 5.2
  X-Frame-Options: SAMEORIGIN
  X-AspNet-Version: 4.0.30319
  X-SourceFiles: =?UTF-8?B?RDpcRUJTLkNvZGVcUHJvamVjdHNcQ1ZSUE9TX1dlYlNpdGVcQ1ZSUE9TX1dlYlNpdGVcQWNjb3VudFxMb2dpbg==?=
  X-Powered-By: ASP.NET
  Date: Thu, 04 Dec 2014 10:00:00 GMT
  Content-Length: 4434
  [View page content]
  </code></pre>
  
  <p><strong>EDIT 2</strong>:</p>
  
  <p>This is what my app sends for GET and POST:</p>
  
  <pre><code>GET http://localhost:57457/Account/Login HTTP/1.1
  Host: localhost:57457
  Connection: Keep-Alive
  
  POST http://localhost:57457/Account/Login HTTP/1.1
  Content-Type: application/x-www-form-urlencoded
  Host: localhost:57457
  Cookie: __RequestVerificationToken=df9nBSP_J1IiLrv84RwrkmvbYBrnH4iqv97wRvz6HMPLWBhgI4XzGeAFcschovHwD8mTtHU6xrmVxz1Ku96_BaoB79le_vLTcrgGemU4gjc1
  Content-Length: 163
  Expect: 100-continue
  
  __RequestVerificationToken=df9nBSP_J1IiLrv84RwrkmvbYBrnH4iqv97wRvz6HMPLWBhgI4XzGeAFcschovHwD8mTtHU6xrmVxz1Ku96_BaoB79le_vLTcrgGemU4gjc1&amp;UserName=test&amp;Password=test
  </code></pre>
  
  <p>And finally this is the error:</p>
  
  <p><strong>[HttpAntiForgeryException (0x80004005): Validation of the provided anti-forgery token failed. The cookie &quot;__RequestVerificationToken&quot; and the form field &quot;__RequestVerificationToken&quot; were swapped.]</strong></p>
  
  <p>Thanks!</p>