I have an ASP.NET Webpages Razor syntax page which all of a sudden has stopped authenticating users!
If a user tries to login to the site now the server responds with the message:
The required anti-forgery form field "__RequestVerificationToken" is not present.
Well.... It is!
Looking at the source of my login page it does add the hidden field as seen below..
<section id="loginForm">
<form method="post">
<fieldset>
<input name="__RequestVerificationToken" type="hidden" value="WgwaKIsXipJ4C8IRsaz__C_tW02ejupv8af-w3czwefo2AEacVlGs_k-lFNRfLqWr0inzHxtkEnXgPKZMvacv5u1LVfLphIP8R1JGukMZcA1" />
<legend>Sign in to Your Account</legend>
<ol>
<li class="email">
<label for="email" >Username</label>
<input type="text" id="email" name="username" />
<span class="field-validation-valid" data-valmsg-for="username" data-valmsg-replace="true"></span>
</li>
<li class="password">
<label for="password" >Password</label>
<input type="password" id="password" name="password" />
<span class="field-validation-valid" data-valmsg-for="password" data-valmsg-replace="true"></span>
</li>
<li class="remember-me">
<input type="checkbox" id="rememberMe" name="rememberMe" />
<label class="checkbox" for="rememberMe">Remember me?</label>
</li>
</ol>
<input type="submit" value="Sign in" />
</fieldset>
</form>
</section>
To create this field I use @AntiFogery.GetHTML() and in the post method which authenticates users I have @AntiForgery.Validate() <---- This is where the website crashes and shows me the aforementioned error.
I don't know if this helps. but if i remove the validation all together (Server and client) I get a 403 error when attempting to login to the website.
Oddly enough this has happened all of a sudden without any intervention?
Finally, On my local machine this does not happen. Only when hosted on IIS 8
I have finally discovered the issue with the IIS Server!
On my webserver I have a tool called ModSecurity Installed that was obviously interfering with my POST requests.
By adding the line, <ModSecurity enabled="false" />, into the web.config of the site everything was returned to its original state.
I hope this helps anyone else in the future with this issue