Managing invalid cookie when 2 users use the same computer and therefore share the same cookie

Question

I have asked this question on stackoverflow... here, I am asking for some feedback on the solution that I have implemented.

---

I am using ASP.NET MVC default template to logout user:

// POST: /Account/LogOff
[HttpPost]
[ValidateAntiForgeryToken]
public ActionResult LogOff()
{
    AuthenticationManager.SignOut(DefaultAuthenticationTypes.ApplicationCookie);
    return RedirectToAction("index", "home");
}

The above code is part of MVC web template, I have not changed anything. There is a edge case scenario that I get the following error:

The provided anti-forgery token was meant for a different claims-based user than the current user

How to reproduce the error:

User1 and User2 are both using the same computer, they both use Chrome (i.e. share the cookie). User1 logs in to my-website.com and does not log out. 10 mins later, Users2 uses the same computer, opens a new chrome tab and logs in to my-website.com. This would invalidate User1's cookie... 10 min later User1 comes back to the computer and opens the original tab... User1 is unaware that his cookie is no longer valid and the website still shows him as the logged in user (if he refreshes the page, he would notice that User2 is logged in, but if he does not refresh the tab, it appears that he is still logged in). Now when User1 clicks logout he gets the above error, because his AntiForgeryToken is no longer valid... and he keeps getting the error until he refreshes the page.

This is edge case scenario but I have got this error several times, because I have 2 different users using the same computer.

My solution

// POST: /Account/LogOff
[HttpPost]
// [ValidateAntiForgeryToken] <-- removed
public ActionResult LogOff()
{
    AuthenticationManager.SignOut(DefaultAuthenticationTypes.ApplicationCookie);
    return RedirectToAction("index", "home");
}

I have decided to remove the validation of anitforgery token from this action method... this way, user can always logoff... I think the worst thing an attacker can do is to logoff a user and I think that should be OK...

Other Issues

Given the same scenario, when User1 comes back to the website, unaware that his token is invalidated, he may perform any other post action and he would get the same Invalid AntiForgery error...