ASP.net MVC cross application POST request
<p>I have several ASP.net MVC applications deployed on a single site in IIS. All of the applications are using forms authentication, and all of the applications are configured to use the same machine key. </p>

<p>One of the applications is a 'base site' which provides navigation to the other applications and is where login/logout functionality is being handled. As it stands, a user can log in on the base site and visit the other applications and they will still be authenticated, which is working as intended. </p>

<p>I have a logout form in the header of my shared layout views which submits a post request to the logout action in a controller belonging to the base site. When I submit this form from the base site, the logout works as expected. But if I try to submit the form from any of the other sites, I receive the error message:</p>

<pre><code>"The anti-forgery cookie token and form field token do not match."
</code></pre>

<p>This is what my log off action looks like in my Security controller:</p>

<pre><code>    [HttpPost]
    [ValidateAntiForgeryToken]
    public ActionResult LogOff()
    {
        FormsAuthentication.SignOut();

        return Redirect("~/");
    } 
</code></pre>

<p>This is what my form looks like in the base site view:</p>

<pre><code>using (Html.BeginForm("LogOff", "Security", FormMethod.Post, null))
                {
                    @Html.AntiForgeryToken()
                    &lt;input type="submit"  value="Log Off"/&gt;
                }
</code></pre>

<p>Because of the way the directories are set up the other sites use a slightly different version of the same form to call the logout action from the base site:</p>

<pre><code>using (Html.BeginForm("LogOff", "../Security", FormMethod.Post, null))
                {
                    @Html.AntiForgeryToken()
                    &lt;input type="submit"  value="Log Off"/&gt;
                } 
</code></pre>

<p>The base site is at the root of the directory, and the other applications are contained in their own folder within that root.</p>

<p>None of the views I have tried this on have any conflicting forms or antiforgery tokens, and the machine key among all the apps seems to be configured properly or else I don't think the authentication would be working at all. I am considering just redirecting to the base site and performing the logout action from there, but if there is another more simple solution that I have yet to come across that would be nice.</p>