Responding to comments and removing null check for CookieToken

Author: harshgMSFT

src/Microsoft.AspNet.Mvc.Core/AntiForgery/AntiForgery.cs

@@ -53,6 +53,10 @@ public HtmlString GetHtml([NotNull] HttpContext context)
         /// <param name="oldCookieToken">The anti-forgery token - if any - that already existed
         /// for this request. May be null. The anti-forgery system will try to reuse this cookie
         /// value when generating a matching form token.</param>
+        /// <remarks>
+        /// Unlike the GetHtml(HttpContext context) method, this method has no side effect. The caller
+        /// is responsible for setting the response cookie and injecting the returned
+        /// form token as appropriate.
         /// </remarks>
         public AntiForgeryTokenSet GetTokens([NotNull] HttpContext context, string oldCookieToken)
         {
@@ -66,7 +70,7 @@ public AntiForgeryTokenSet GetTokens([NotNull] HttpContext context, string oldCo
 
         /// <summary>
         /// Validates an anti-forgery token that was supplied for this request.
-        /// The anti-forgery token may be generated by calling GetHtml().
+        /// The anti-forgery token may be generated by calling GetHtml(HttpContext context).
         /// </summary>
         /// <param name="context">The HTTP context associated with the current call.</param>
         public async Task ValidateAsync([NotNull] HttpContext context)

src/Microsoft.AspNet.Mvc.Core/AntiForgery/AntiForgeryToken.cs

@@ -7,19 +7,16 @@ internal sealed class AntiForgeryToken
         internal const int SecurityTokenBitLength = 128;
         internal const int ClaimUidBitLength = 256;
 
-        private string _additionalData;
+        private string _additionalData = string.Empty;
+        private string _username = string.Empty;
         private BinaryBlob _securityToken;
-        private string _username;
 
         public string AdditionalData
         {
-            get
-            {
-                return _additionalData ?? String.Empty;
-            }
+            get { return _additionalData; }
             set
             {
-                _additionalData = value;
+                _additionalData = value ?? string.Empty;
             }
         }
 
@@ -45,13 +42,10 @@ public BinaryBlob SecurityToken
 
         public string Username
         {
-            get
-            {
-                return _username ?? String.Empty;
-            }
+            get { return _username; }
             set
             {
-                _username = value;
+                _username = value ?? string.Empty;
             }
         }
     }

src/Microsoft.AspNet.Mvc.Core/AntiForgery/AntiForgeryTokenSerializer.cs

@@ -38,9 +38,7 @@ public AntiForgeryToken Deserialize(string serializedToken)
                 // swallow all exceptions - homogenize error if something went wrong
             }
 
-            // TODO: Return proper exception here.
             // if we reached this point, something went wrong deserializing
-            //  throw HttpAntiForgeryException.CreateDeserializationFailedException();
             throw new InvalidOperationException(Resources.AntiForgeryToken_DeserializationFailed);
         }
 
@@ -128,8 +126,6 @@ public string Serialize([NotNull] AntiForgeryToken token)
             }
         }
 
-        // TODO: This is temporary replacement for HttpServerUtility.UrlTokenEncode.
-        // This will be removed when webutils has this.
         private string UrlTokenEncode(byte[] input)
         {
             var base64String = Convert.ToBase64String(input);
@@ -161,8 +157,6 @@ private string UrlTokenEncode(byte[] input)
             return sb.ToString();
         }
 
-        // TODO: This is temporary replacement for HttpServerUtility.UrlTokenDecode.
-        // This will be removed when webutils has this.
         private byte[] UrlTokenDecode(string input)
         {
             var sb = new StringBuilder();

src/Microsoft.AspNet.Mvc.Core/AntiForgery/AntiForgeryTokenSet.cs

@@ -12,17 +12,15 @@ public AntiForgeryTokenSet(string formToken, string cookieToken)
                 throw new ArgumentException(Resources.ArgumentCannotBeNullOrEmpty, formToken);
             }
 
-            if (string.IsNullOrEmpty(cookieToken))
-            {
-                throw new ArgumentException(Resources.ArgumentCannotBeNullOrEmpty, cookieToken);
-            }
-
             FormToken = formToken;
             CookieToken = cookieToken;
         }
 
         public string FormToken { get; private set; }
 
+        // The cookie token is allowed to be null. 
+        // This would be the case when the old cookie token is still valid.
+        // In such cases a call to GetTokens would return a token set with null cookie token.
         public string CookieToken { get; private set; }
     }
 }