title: CSRF Test are failed in ASP.NET MVC Application
body: <p>I have completed an ASP.NET MVC application and at the end we are going through a security test. I have passed all the tests except two. One is CSRF. In my application I have put <code>@Html.AntiForgeryToken()</code> on every form to be submitted to the server and the respective action method is decorated with a <code>ValidateAntiForgeryToken</code> attribute. After an exercise, I think I am correct since most of internet suggests to do what I am actually doing, but the testing team is saying that CSRF has failed. Now, they are putting forward a remark that value in cookie is not changed on every request, but that it changes on the form page.</p>
  
  <p><em>I am not sure why the value is changing in page but not in cookie?</em></p>