AntiForgeryToken for LogOff in ASP.NET MVC 3

I have the following antiforgerytoken defined on my login page like this:

<%=Html.AntiForgeryToken(Constants.AntiForgerySalt)%>

My login method looks like this:

    [ValidateAntiForgeryToken(Salt = Constants.AntiForgerySalt)]
    public ActionResult Log开发者_JAVA百科In(string userName, string password, string attemptsKey)
    {
        .....
    }

All works good, apart from the way I handle logging out.

For logging out, I have an actionlink defined like this:

<%=Html.ActionLink("Logout", "LogOut", "LogIn")%>

This obviously means that there is no form being posted to the server.

The logout action specified in the ActionLink executes but when it redirects to the login page which has the AntiForgeryToken specified, I get the following error message:

A required anti-forgery token was not supplied or was invalid.

I am surprised by this as I thought it only applied to scenarios where data was being posted.

If I am redirecting to a page that only has the AntiForgeryToken being rendered then why is this error message happening?

Your easiest solution is to decorate Login(..) with [HttpPost], and create a Login(..) action decorated with [HttpGet] which serves the Login page. This will prevent the action link from triggering this action.