Hi,
we're using an OpenID server for authentication. After switching Piranha from 9 to 10 it was not possible to save/publish pages or to store site properties. After investigating the log messages, I found that the antiforgery cookie was not present.
The built in authentication method (LocalAuth) redirects after a successful login to "/manager/login/auth" where the cookie will be set.
After several tries I ended up in writing a middleware which redirects to "/manager/login/auth" if the first call to the manager appears (I did not want to copy and paste the code from AuthController.cs) .

A few comments on this:

• the behavior should be part of the documentation
• the creation of the antiforgery cookie could be implemented in a service
• maybe there is a more common scenario to ensure that the cookie is created independently of the authentication

Do you have other ideas or solutions for the problem?
Thanks.