I've created a REST store like this:

    [RestStore("mystore")]
    public class MyStore : RestControllerBase
    {
        [HttpPost]
        public ActionResult Post()
        {
            return Rest(new { result = "POST works." });
        }

        [HttpGet]
        public ActionResult Get()
        {
            return Rest(new { result = "GET works." });            
        }

        [HttpPut]
        public ActionResult Put()
        {
            return Rest(new { result = "PUT works." });                    
        }
    }

I can get the store just fine in a Dojo widget, and when doing store.get() I get the correct result. It also works when doing a GET request through Postman.

However, when doing a POST or PUT, I get the anti-forgery validation error saying "This request has probably been tampered with. Close the browser and try again."

The stack trace says the requests fails at EPiServer.Shell.Services.Rest.RestHttpHandler.ValidateAntiForgeryToken(HttpContextBase httpContext).

Any bright ideas? :)