asp.net mvc 4 - AntiForgery.Validate() vs ValidateAntiForgeryToken -

does method system.web.helpers.antiforgery.validate(); perform same function [validateantiforgerytoken] decoration?

i'm thinking of changing log out method too:

    [httppost]             public virtual actionresult logoff()             {         if (user.identity.name != "")         {             system.web.helpers.antiforgery.validate();             websecurity.logout();         }                     return redirecttoaction(mvc.account.login());     } 

this prevent anti forgery exception being thrown when system has logged out due login expiring. want antiforgery.validate() perform same task validateantiforgerytoken.

i using additional exception handler catch exception. problem remained elmah still logged exception, , i'm getting many messages.

it seem both approaches validate antiforgerytoken present in form. have checked assemblies , validateantiforgerytokenattribute call antiforgery.validate method validation. both approaches throw httpvalidateantiforgeryexception when validation fails. short answer whether perform same task yes.

there subtle difference in fact validateantiforgerytokenattribute validates token earlier in mvc execution cycle-in onauthorization method. may make difference in performance if execute resource intensive task in controller action before doing antiforgerytoken.validate() check.

another thing note may creating work (not mention possible security holes left when omitting it) requiring each httppost action have following piece of code

if (user.identity.name != "") {     system.web.helpers.antiforgery.validate();     websecurity.logout(); } 

by creating following attribute , decorating post methods have desired functionality , not required have above code in every post action

using system; using system.web.mvc;  [attributeusage( attributetargets.method | attributetargets.class , allowmultiple = false , inherited = true )] public class validateorsignoutantiforgerytokenattribute :      filterattribute ,      iauthorizationfilter {      public void onauthorization( authorizationcontext filtercontext )     {         if( filtercontext == null )         {             throw new argumentnullexception( "filtercontext" );         }          if( filtercontext.httpcontext.user != null &&             filtercontext.httpcontext.user.identity.name != "" )         {             try             {                 system.web.helpers.antiforgery.validate();             }             catch             {                 websecurity.logout();                 throw;             }         }     }  } 

one last thing, exceptions normal in validation of antiforgery. because antiforgery.validate method throws httpvalidateantiforgeryexception when validation fails. see in code above have caught exception , re-thrown after completing logout.