title: Handle AntiForgery Token in Winform and WebAPI
body: <p>What's the best way to deal with Antiforgery on methods with <code>ValidateAntiForgeryTokenAttribute</code> attribute while calling from a non-browser client, say <code>WinForm</code>? </p>
  
  <p>Based on what I know, below is how anti forgery works:</p>
  
  <ol>
  <li><p>A hidden input field is added to the page, e.g. </li>
  <li><p>A cookie with the same name is also sent to the client</p></li>
  <li><p>On the next request, both the cookie and the hidden input field is sent to server. Server calls <code>AntiForgery.Validate(token, cookie)</code> to confirm that the request is legit.</p></li>
  </ol>
  
  <p>All works fine in a web app. It doesn't seem to work in WinForm. Here is what I do:</p>
  
  <ol>
  <li>Using <code>HttpClient</code>, I do a get to a page containing the token. </li>
  <li>I parse the page and grab the hidden input field. I also pick up the cookie.</li>
  <li>I pass the cookie as is. On top of that, I add a new header <code>__RequestVerificationToken</code> with value from the hidden field.</li>
  <li>I step into the server code.</li>
  <li>The <code>AntiForgery.Validate(xx,yy)</code> fails with error: 
  <strong>The provided anti-forgery token was meant for user X, but the current user is Y.</strong></li>
  </ol>