Antiforgery tokens

[sebastienros]

Anti-forgery tokens can't be cached as they are user specific values, even for anonymous users. Hence if a response is rendered with another's token the form will fail.

Options:

1. This can be done with the anti-forgery token generator create a no-cache header. It's already setting the cookie.
   The issue with this is that this can lead to lots of cache misses. For instance if a layout contains a login form in the header (quite common) or a blog engine rendering a comments form for the posts.
2. A solution to still cache these would be to substitute the token value with a beacon when storing the cache entry, then substituting it when the page is rendered. Like using a standard ESI one that would also work for edge servers. https://www.varnish-cache.org/docs/3.0/tutorial/esi.html

If done correctly it could be generalized to support other user specific values to extend support for authenticated cached pages.

[muratg]

This should be already fixed with option 1. (aspnet/Antiforgery#105)