When you first log in to the local site, get an anti-fake cookie token error, when try a second time, this is normal

Question

Please note that I already put the machine key in both of my web.config project files, and I already checked that there are not a few @ Html.AntiForgeryToken (), as described here . I have two projects developed in Asp.Net 4, when I deploy locally, I give an error the first time, and the second time there is no problem. I also delete cookies and browsing history, just to make sure, but the same result.

Internal server error

The fake ban cannot be decrypted. If this application is hosted by a web farm or cluster, make sure that all machines are running the same version of ASP.NET web pages and that the Configuration sets explicit encryption and verification keys. AutoGenerate cannot be used in a cluster.

System.Web.Mvc.HttpAntiForgeryException (0x80004005): The anti-forgery token could not be decrypted. If this application is hosted by a Web Farm or cluster, ensure that all machines are running the same version of ASP.NET Web Pages and that the <machineKey> configuration specifies explicit encryption and validation keys. AutoGenerate cannot be used in a cluster.
   at System.Web.Helpers.AntiXsrf.AntiForgeryTokenSerializer.Deserialize(String serializedToken)
   at System.Web.Helpers.AntiXsrf.AntiForgeryTokenStore.GetCookieToken(HttpContextBase httpContext)
   at System.Web.Helpers.AntiXsrf.AntiForgeryWorker.Validate(HttpContextBase httpContext)
   at System.Web.Helpers.AntiForgery.Validate()
   at System.Web.Mvc.ValidateAntiForgeryTokenAttribute.OnAuthorization(AuthorizationContext filterContext)
   at System.Web.Mvc.ControllerActionInvoker.InvokeAuthorizationFilters(ControllerContext controllerContext, IList`1 filters, ActionDescriptor actionDescriptor)
   at System.Web.Mvc.Async.AsyncControllerActionInvoker.<>c__DisplayClass1e.<BeginInvokeAction>b__16(AsyncCallback asyncCallback, Object asyncState)

Answer 1

I have a similar problem. I have another virtual directory for webapi in the main application. I checked that there is only one token in the page source and having the same machine key both in the main application and in webapi.