{"record":{"id":"16410e2919bfa6ed","repo":"dotnet/aspnetcore","slug":"the-provided-antiforgery-token-was-meant-for-user","errorCode":null,"errorMessage":"The provided antiforgery token was meant for user \"{0}\", but the current user is \"{1}\".","messagePattern":"The provided antiforgery token was meant for user \"(.+?)\", but the current user is \"(.+?)\"\\.","errorType":"exception","errorClass":"AntiforgeryValidationException","httpStatus":null,"severity":"error","filePath":"src/Antiforgery/src/Internal/DefaultAntiforgery.cs","lineNumber":200,"sourceCode":"\n        // Extract cookie & request tokens\n        AntiforgeryToken deserializedCookieToken;\n        AntiforgeryToken deserializedRequestToken;\n\n        DeserializeTokens(\n            httpContext,\n            antiforgeryTokenSet,\n            out deserializedCookieToken,\n            out deserializedRequestToken);\n\n        // Validate\n        if (!_tokenGenerator.TryValidateTokenSet(\n            httpContext,\n            deserializedCookieToken,\n            deserializedRequestToken,\n            out var message))\n        {\n            throw new AntiforgeryValidationException(message);\n        }\n    }\n\n    /// <inheritdoc />\n    public void SetCookieTokenAndHeader(HttpContext httpContext)\n    {\n        ArgumentNullException.ThrowIfNull(httpContext);\n\n        CheckSSLConfig(httpContext);\n\n        var antiforgeryFeature = GetCookieTokens(httpContext);\n        if (!antiforgeryFeature.HaveStoredNewCookieToken && antiforgeryFeature.NewCookieToken != null)\n        {\n            if (antiforgeryFeature.NewCookieTokenString == null)\n            {\n                antiforgeryFeature.NewCookieTokenString =\n                    _tokenSerializer.Serialize(antiforgeryFeature.NewCookieToken);\n            }","sourceCodeStart":182,"sourceCodeEnd":218,"githubUrl":"https://github.com/dotnet/aspnetcore/blob/294cab2f9b2e03af6b953820c7ab497c3c8b7ad9/src/Antiforgery/src/Internal/DefaultAntiforgery.cs#L182-L218","documentation":"Thrown during TryValidateTokenSet when the Username baked into the request token does not match the current authenticated user's name. The antiforgery system binds each request token to the identity of the user for whom it was generated; if a different user submits it, validation fails. Results in AntiforgeryValidationException. The message is produced by FormatAntiforgeryToken_UsernameMismatch at DefaultAntiforgeryTokenGenerator.cs:173.","triggerScenarios":"An authenticated user 'A' loads a form (request token bound to 'A'), then user 'B' (or a logged-out session) submits that form. Detected at line 169 when !comparer.Equals(requestToken.Username, currentUsername) and the current user IS authenticated but under a different name.","commonSituations":"Two users sharing a browser without logging out; a cached page or back-button submission after login as a different user; concurrent sessions where a tab's tokens are cross-submitted; custom authentication that changes the IIdentity.Name claim after the token was minted.","solutions":["After login/logout, redirect to a fresh page so new antiforgery tokens are generated for the new identity.","Ensure NameClaimType is set consistently in authentication configuration so IIdentity.Name resolves to a stable, unique identifier.","Add Cache-Control: no-store to pages containing forms so the browser doesn't reuse a previous user's tokens.","If using custom authentication, verify the ClaimsIdentity.Name matches the value used at token generation time."],"exampleFix":"// before — stale page submitted after switching users\n// (user A's form submitted after logout/login as user B)\n\n// after — invalidate and regenerate tokens on auth change\nawait _signInManager.SignOutAsync();\nawait _antiforgery.GetAndStoreTokens(HttpContext); // fresh tokens for next identity\nreturn RedirectToPage(\"/Login\");","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try\n{\n    await _antiforgery.ValidateRequestAsync(HttpContext);\n}\ncatch (AntiforgeryValidationException ex)\n{\n    _logger.LogWarning(\"Token user mismatch: {Msg}\", ex.Message);\n    return Challenge(); // force re-authentication\n}","preventionTips":["Redirect to a fresh page after login/logout to regenerate tokens.","Set Cache-Control: no-store on pages with forms to prevent cross-user token reuse.","Keep NameClaimType consistent across authentication scheme changes."],"tags":["antiforgery","security","csrf","authentication","token-validation"],"analyzedSha":"294cab2f9b2e03af6b953820c7ab497c3c8b7ad9","analyzedAt":"2026-08-06T20:08:02.189Z","schemaVersion":2},"datasetVersion":"2026-08-06T23:17:07.152Z"}