Random "The anti-forgery cookie token and form field token do not match" in Azure

4
votes

We are getting random "The anti-forgery cookie token and form field token do not match" errors showing up in the error log in with our site hosted in Azure. After realizing that we needed a static machine key, we added to that to the web.config with the validationKey and decryptionKey attributes, however, we still have the random error popping up.

Just to define my use of "random" here, out of every ~200-300 form submissions, this happens once or twice. It just feels like too much to have happen and it's a real interruption to our clients that trust our services.

One other thought that crossed my mind is whether this is happening on machines that don't have cookies enabled. I haven't been able to verify that one way or another, but I didn't know if cookies are a requirement for the ValidateAntiForgeryToken to work. If it does require cookies, then should we pop up a message to our users letting them know that cookies are required for proper use?

I could use help coming up with ways to diagnose this or other ideas of how to handle this.

Thank you in advance.

[UPDATE] I just heard from a user where I saw this error popup. It turns out that they loaded the page and walked away for a while causing the error. That's great news since that means that the validation is just doing its job and nothing crazy was happening...I just need to verify if that data point is indicative of the rest of the users. So given that, how do you all handle situations where the token expires? Do you notify the user in some clean way?

2
asp.net-mvcazureantiforgerytoken
Is someone trying to submit malicious form data, i.e. is the token doing it's job? – Liam
Really, who knows. Without recreation steps it could be many reasons – Liam
These are real users that are legitimately attempting to use our services, so I don't see a reason for them submitting malicious form data. There also the other form of malicious data like using Html or script tags but that generates a different type of error. – lostdeveloper
As for reproduction steps, that's the hard part in all of this since we can't replicate it ourselves. It's just an odd scenario all around. – lostdeveloper
Perhaps this will help: stackoverflow.com/questions/5767768/… – Peter B

2 Answers

0
votes

Do you have a server farm ? i.e. do you have an App Service with auto-scaling enabled ? or a cloud service with several machines ?

If yes, check that all your machinekeys are defined with the same value in all your web.config files. The machinekey is used to generate AntiForgery tokens.

0
votes

Could you log the headers of the failed requests ? You can add some code in your global.asax on Application_Error like :

foreach (string header in request.Headers)
{
     // header <== header name
     // request.Headers[header]) <== header value
 }