I am developing an ASP.NET Core Web Application using a combination of MVC Views and Web APIs. I also use Identity for user management.
I now want to enable Anti-Request-Forgery Tokens for our Web API. For that, I use the IAntiForgery service in Razor views to GetAndStoreTokens and forward the RequestToken to a $.ajax call as a header, as described in the official documentation in section JavaScript.
When I run the corresponding page that performs a Web API request with the user being signed in (Cookie-Authentication), I can also see that the request token is set properly as an HTTP Header (see orange box in image). However, the Anti-Forgery validation of ASP.NET Core denies the request with the following message:
Antiforgery token validation failed. The required antiforgery cookie ".AspNetCore.Antiforgery.ybHEizTXFmU" is not present.
Thus, the cookie-part of the Anti-Forgery-Token (blue box) is the problem here - the key starts with a different ID: .AspNetCore.Antiforgery.lUjKpn5xN20 instead of .AspNetCore.Antiforgery.ybHEizTXFmU
How can this happen? The Web App and Web API reside in the same process / at the same domain, so no Cross-Origin-Calls are performed. Is this a problem of $.ajax (which I can't explain because the browsers cookies of the target site should be reused) or a problem within the ASP.NET Core Anti-Forgery (or even Identity) module?