title: what is the use of anti-forgery token salt?
body: <p>In ASP.NET MVC 1.0, there is a new feature for handling cross site request forgery security problem:</p>
  
  <pre><code> &lt;%= Html.AntiForgeryToken() %&gt;
  [ValidateAntiForgeryToken]
  public ViewResult SubmitUpdate()
  {
      // ... etc
  }
  </code></pre>
  
  <p>I found the token generated in html form keep changing every time a new form is rendered.</p>
  
  <p>I want to know how these token is generated? And when use some software to scan this site, it will report another security problem: Session fixed. Why? Since the token keep changed, how can this problem come ?</p>
  
  <p>And there is another function, that is "salt" for the <code>antiForgeryToken</code>, but I really know what this used for, even through we don't use "salt" to generate the token, the token will changes all the time, so why have such function?</p>