Cacher is the code snippet organizer for pro developers

The antiforgery token could not be decrypted.
Login:42 Microsoft.AspNetCore.Antiforgery.Internal.DefaultAntiforgeryTokenSerializer

Anti-forgery token to prevent CSRF (Cross-Site Request Forgery) attacks.
Проставляются автоматически  при
1.При использовании TagHelper (выделяются фиолетовым в vs)
2. you need to set the “asp-controller” and “asp-action” attributes 
3. Можно увидеть открыв консоль .
More importantly: the Form TagHelper by default supports the attribute “asp-antiforgery” already set to true. Then, there is no need to change anything on the form to get the Anti-forgery token support.

 [ValidateAntiForgeryToken]атрибут должен стоять перед post запросами

Происходила только на сервере и если истекла сессия и юзера выбрасывало на страницу залогинивания. При нажатие войти появлялось сообщение об этой ошибке.
Проблемы которые могут это вызватьт
1,Если есть вызовы генерации antiforgery token в нескольких местах View
2. http://iamdotnetcrazy.blogspot.no/2013/08/how-to-solve-anti-forgery-token-could.html
session terminates. At that point, the system loses a reference to those auto-generated keys. Then, when you are kicked out of the system and have to come back, it still has a reference to the old keys, but those are not usable anymore - since the system generated new ones for your new session. All of a sudden, the new one the system generated and the old one your page is referencing are not in sync and you get the error.



3. 	and what about domain on which csrf cookies are set? Are you using your unique subdomain? If not, your application might receive cookies from other .NET application running on the same root domain. 

4. 	Shared-hosting vendor hosts  application not on just one web server. Web-farm



Solutions

The Anti-ForgeryToken process places an input value in the form with a second value stored in a cookie RequestVerificationToken. Both of these are submitted to the server and if they don't match the error is thrown.
The RequestVerficationToken cookie has an expiration value set to be Session. So when the user leaves the browser open on the page for a long time and then sub-mits, the cookie's time stamp is compared to the session timeout value on the serv-er — a default of 20 minutes or so — and having been exceeded, it is removed and thus token validation fails.
Possible solutions, all of which have potential issues;



1.	Put a javascript timer on the page and refresh at some value less than your session timeout.
2.	Catch the System.Web.Mvc.HttpAntiForgeryException on the server — and re-direct to the same page.
3.	Increase your session timeout
4.	Change the expiration on the anti-forgery token

почитать
https://stackoverflow.com/questions/14421962/asp-net-mvc3-antiforgerytoken

Итак, получается, что сервер генерит условно говоря случайное число, отдает его в поле формы и одновременно в виде куки, а при постинге формы проверяет совпадение значения куки и скрытого поля (при этом само контрольное значение на сервере никак не хранится)
This is an authorization filter that checks that:
The incoming request has a cookie called __RequestVerificationToken
The incoming request has a Request.Form entry called __RequestVerificationToken
These cookie and Request.Form values match

The antiforgery framework compares a hidden field to a cookie.  Session is not involved.

Some quiestion about antiforgery token
When we submit form then antiforgery token related data stored in cookie and hidden field passed to server action method. I like know what server does to validate both data?

the same data is stored in cookie and hidden field?

how session is related to antiforgery data? Any antigorgery related data is stoted in session variable?

if cookie is disabled at client side then how antiforgery token will work?
1.The anti-forgery support writes a unique value to an Http-only cookie. Then, the same value is set to a hidden form field. When submitting the form, ValidateAntiForgeryToken attribute will check these two value. If the form value can't match the cookie value, it will raise an error.

2.Session is not required for anti-forgery token. Anti-forgery related data is stored in a Http-only cookie. You can check this article for more details.

3.If cookie is disabled in browser, anti-forgery can't work correctly.

Here are some links about anti-forgery, you can also refer to them.