{"record":{"id":"9ae04ecc3d142912","repo":"dotnet/aspnetcore","slug":"the-provided-antiforgery-token-was-meant-for-a-dif","errorCode":null,"errorMessage":"The provided antiforgery token was meant for a different claims-based user than the current user.","messagePattern":"The provided antiforgery token was meant for a different claims-based user than the current user\\.","errorType":"exception","errorClass":"AntiforgeryValidationException","httpStatus":null,"severity":"error","filePath":"src/Antiforgery/src/Internal/DefaultAntiforgery.cs","lineNumber":200,"sourceCode":"\n        // Extract cookie & request tokens\n        AntiforgeryToken deserializedCookieToken;\n        AntiforgeryToken deserializedRequestToken;\n\n        DeserializeTokens(\n            httpContext,\n            antiforgeryTokenSet,\n            out deserializedCookieToken,\n            out deserializedRequestToken);\n\n        // Validate\n        if (!_tokenGenerator.TryValidateTokenSet(\n            httpContext,\n            deserializedCookieToken,\n            deserializedRequestToken,\n            out var message))\n        {\n            throw new AntiforgeryValidationException(message);\n        }\n    }\n\n    /// <inheritdoc />\n    public void SetCookieTokenAndHeader(HttpContext httpContext)\n    {\n        ArgumentNullException.ThrowIfNull(httpContext);\n\n        CheckSSLConfig(httpContext);\n\n        var antiforgeryFeature = GetCookieTokens(httpContext);\n        if (!antiforgeryFeature.HaveStoredNewCookieToken && antiforgeryFeature.NewCookieToken != null)\n        {\n            if (antiforgeryFeature.NewCookieTokenString == null)\n            {\n                antiforgeryFeature.NewCookieTokenString =\n                    _tokenSerializer.Serialize(antiforgeryFeature.NewCookieToken);\n            }","sourceCodeStart":182,"sourceCodeEnd":218,"githubUrl":"https://github.com/dotnet/aspnetcore/blob/294cab2f9b2e03af6b953820c7ab497c3c8b7ad9/src/Antiforgery/src/Internal/DefaultAntiforgery.cs#L182-L218","documentation":"Thrown during TryValidateTokenSet when the request token carries a ClaimUid (a claims-based identifier) that does not match the ClaimUid derived from the current user's claims. Unlike username-based binding, claims-based binding hashes the user's claim set; a mismatch indicates the claim set changed or belongs to a different user. Produced by Resources.AntiforgeryToken_ClaimUidMismatch at DefaultAntiforgeryTokenGenerator.cs:181.","triggerScenarios":"The current user is authenticated with claims (so TryExtractClaimUidBytes succeeds) but the computed ClaimUid differs from the ClaimUid embedded in the request token. Detected via AreIdenticalClaimUids returning false at line 177.","commonSituations":"User's claims or roles changed after the token was minted (e.g., admin role granted/revoked); token generated by a different claims configuration; custom claim types that vary between requests; upgrading authentication schemes so claim extraction logic changed.","solutions":["Regenerate the antiforgery token after claims change (e.g., after role assignment) by calling GetAndStoreTokens and reloading the page.","Ensure claim extraction is deterministic — verify ClaimUidExtractor uses stable, consistent claim types across all requests.","If claims legitimately change often, consider falling back to username-based validation by not populating extractable claims, or implement IAntiforgeryAdditionalDataProvider."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try\n{\n    await _antiforgery.ValidateRequestAsync(HttpContext);\n}\ncatch (AntiforgeryValidationException ex)\n{\n    _logger.LogWarning(\"ClaimUid mismatch: {Msg}\", ex.Message);\n    return BadRequest(\"Session changed — please reload.\");\n}","preventionTips":["Regenerate antiforgery tokens after any claims/role change.","Use stable claim types for ClaimUid extraction so the hash is deterministic."],"tags":["antiforgery","security","csrf","claims","token-validation"],"analyzedSha":"294cab2f9b2e03af6b953820c7ab497c3c8b7ad9","analyzedAt":"2026-08-06T20:08:02.189Z","schemaVersion":2},"datasetVersion":"2026-08-06T23:17:07.152Z"}