Hi!
In the VS 2012 Web Forms project template, in the Master page, there is a handle for anti-xsrf attacks, which basically stores in the ViewState the token (ViewStateUserKey) and the username of an authenticated user.
However, I have the following problem regarding the validation, in this scenario:
- a user clicks the login button, he logs in, he click the back button (in IE, causing the browser to show the last page without requesting the server in any way) and click Log in again. The problem that arises is that this time the server throws InvalidOperationException,
because the ViewState value of VIewState[AntiXsrfUserNameKey] and Context.User.Identity.Name are different.
How could this be handled correctly?
Thanks in advance for your answer!
...
Go to the complete details ...