Antiforgery token validation failed even when the form that is posted contains the token

[trustieee]

I'm having a weird issue that may or may not be a bug in asp related to CSRF tokens.

I have an action with the following attributes:

[HttpPost]
[ValidateAntiForgeryToken]
[Authorize]

When I post to this, I get:

Antiforgery token validation failed. The required antiforgery request token was not provided in either form field "__RequestVerificationToken" or header value "RequestVerificationToken".

If I check the HTML of the page using Chrome, I see that the form contains the following hidden input:
<input name="__RequestVerificationToken" type="hidden" value="CfDJ8O3lgopbgsJNtDH_fqvyV9D9trRngoK8OrpG0nwsV-aBRi70ONhbzJlxd18xNg1ih7cE2oCRGfhWi1NkyS1RiqS4GRO6B5I-737ciTn3Q9ppPABkKkXoF2QBsn8FE3jMvwkaNRNDtFFV_Fgfh9R2O4DQ9JH8ruFUDXuQczjESTpAsrKJY0oNmArWaNHNvp3wUw">

This should be all that is needed, right?

However, if I manually add a @Html.AntiForgeryToken() at the top of the form, the POST succeeds.
This addition does add the following, which is the same as above:
<input name="__RequestVerificationToken" type="hidden" value="CfDJ8O3lgopbgsJNtDH_fqvyV9D9trRngoK8OrpG0nwsV-aBRi70ONhbzJlxd18xNg1ih7cE2oCRGfhWi1NkyS1RiqS4GRO6B5I-737ciTn3Q9ppPABkKkXoF2QBsn8FE3jMvwkaNRNDtFFV_Fgfh9R2O4DQ9JH8ruFUDXuQczjESTpAsrKJY0oNmArWaNHNvp3wUw">

So by the end of it, I have duplicate __RequestVerificationToken inputs on my form. One that is automatically injected, and the other I manually inject through the @Html helper... but the post only succeeds if I manually use the helper.

Relevant packages:

"Microsoft.AspNetCore.Mvc": "1.0.0-rc2-final"

[rynowak]

Did you close this because you found a solution? I believe we had a bug in this area for RC2. /cc @kichalla

[kichalla]

The part where you are seeing duplicate antiforgery token fields on the form was the bug in RC2(which was fixed for 1.0 release). But based on your description you shouldn't need to add the @Html.AntiforgeryToken again if the antiforgery token field has already been auto-generated(you are probably using tag helper attributes which would cause this).
Could you share how your .cshtml looks like? Or was it a mistake at your end?(since you closed the issue).

[trustieee]

I closed this because it was an issue on my side. I had a form embedded within a form (by mistake). So when the inner form posted, the outer form had the anti forgery token, thus the action didn't receive it.