0

My MVC site uses the antiforgeryToken code, which works well in chrome, firefox. However, in IE10, I have noticed that it gives me the error: required anti-forgery cookie "__RequestVerificationToken" is not present

Definitely a cookie related issue as when I allow all cookies, it works fine. (ie. lowest privacy settings) However, I have also noticed that when I go to GoDaddy and take off domain forwarding masking, (but leave the domain forwarding in) it also works fine.

Is there a way to get this working with the masking? (Masking is an option which allows forwarding of a domain while hiding the non-domain name. I am doing this because I am using Azure websites and would rather have my users see my actual domain name, not xxx.azurewebsites.net)

Thanks for any help here!

tereško
  • 58,060
  • 25
  • 98
  • 150
user3015582
  • 1

1 Answers1

0

Domain forwarding masking works by hosting your real URL inside a frame. In that scenario, your real website content is coming from a different domain than the main page's domain. As such, any cookies your site tries to set will be interpreted as 'third party cookies' and are going to be blocked by any browser set to block those kinds of cookies (including, apparently, IE10 with its default settings).

Frankly, I think you are fighting a losing battle here. These kinds of cookies are benign in your use case, but they look exactly like the kinds of cookies advertisers are using to track people across websites, and so I would expect browsers to be even more hostile to them as time goes by.

I think your options in this case are to not need cookies (e.g. don't use the anti CSRF features provided by ASP.NET MVC), or to move your website to a host that allows you to directly serve your content at the real URL (so that you don't have to use the godaddy masking technique). The latter is probably the best long term solution.

Erv Walter
  • 13,737
  • 8
  • 44
  • 57
  • Thanks for your help. But there must be other sites created using asp.net and azure that have real domain names. (ie. not mysite.azurewebsites.net). – user3015582 Nov 21 '13 at 06:57
  • Yes, azure supports directly assigning real domain names (I use azure for www.ewal.net and trendweight.com), just not on the "free" tier. You have to be on at least the "shared" tier. The setting for domain name setup is on the configuration tab and there are step by step instructions there for what you have to do at GoDaddy to make it work. – Erv Walter Nov 21 '13 at 11:55