New sessions must not validate session data bound to CSRF token.

Author: claudiamurialdo

dotnet/src/dotnetcore/GxNetCoreStartup/CsrfHelper.cs

@@ -74,9 +74,16 @@ public string GetAdditionalData(HttpContext context)
 
 		public bool ValidateAdditionalData(HttpContext context, string additionalData)
 		{
-			bool validSession = context.Session.Id.Trim().CompareTo(additionalData.Trim()) == 0 ? true : false;
-			GXLogging.Warn(log, $"Session id in CSRF token ({additionalData}) does not match the current session id ({context.Session.Id})");
-			return validSession;
+			if (context.IsNewSession())
+			{
+				return true;
+			}
+			else
+			{
+				bool validSession = context.Session.Id.Trim().CompareTo(additionalData.Trim()) == 0 ? true : false;
+				GXLogging.Warn(log, $"Session id in CSRF token ({additionalData}) does not match the current session id ({context.Session.Id})");
+				return validSession;
+			}
 		}
 	}