{"record":{"id":"2d2072a272979b62","repo":"dotnet/aspnetcore","slug":"the-required-antiforgery-form-field-0-is-not-p","errorCode":null,"errorMessage":"The required antiforgery form field \"{0}\" is not present.","messagePattern":"The required antiforgery form field \"(.+?)\" is not present\\.","errorType":"exception","errorClass":"AntiforgeryValidationException","httpStatus":null,"severity":"error","filePath":"src/Antiforgery/src/Internal/DefaultAntiforgery.cs","lineNumber":157,"sourceCode":"    public async Task ValidateRequestAsync(HttpContext httpContext)\n    {\n        ArgumentNullException.ThrowIfNull(httpContext);\n\n        CheckSSLConfig(httpContext);\n\n        var tokens = await _tokenStore.GetRequestTokensAsync(httpContext);\n        if (tokens.CookieToken == null)\n        {\n            throw new AntiforgeryValidationException(\n                Resources.FormatAntiforgery_CookieToken_MustBeProvided(_options.Cookie.Name));\n        }\n\n        if (tokens.RequestToken == null)\n        {\n            if (_options.HeaderName == null)\n            {\n                var message = Resources.FormatAntiforgery_FormToken_MustBeProvided(_options.FormFieldName);\n                throw new AntiforgeryValidationException(message);\n            }\n            else if (!httpContext.Request.HasFormContentType)\n            {\n                var message = Resources.FormatAntiforgery_HeaderToken_MustBeProvided(_options.HeaderName);\n                throw new AntiforgeryValidationException(message);\n            }\n            else\n            {\n                var message = Resources.FormatAntiforgery_RequestToken_MustBeProvided(\n                    _options.FormFieldName,\n                    _options.HeaderName);\n                throw new AntiforgeryValidationException(message);\n            }\n        }\n\n        ValidateTokens(httpContext, tokens);\n\n        _logger.ValidatedAntiforgeryToken();","sourceCodeStart":139,"sourceCodeEnd":175,"githubUrl":"https://github.com/dotnet/aspnetcore/blob/294cab2f9b2e03af6b953820c7ab497c3c8b7ad9/src/Antiforgery/src/Internal/DefaultAntiforgery.cs#L139-L175","documentation":"When HeaderName is null (the default, meaning antiforgery uses a form field) and the request token is not found, the form field named per options.FormFieldName is required. Its absence throws AntiforgeryValidationException. This is the classic form-based antiforgery path.","triggerScenarios":"HeaderName is null and the submitted form body lacks the antiforgery field; the field name was customized and does not match; the field was stripped; the form was not actually submitted (e.g. AJAX JSON POST).","commonSituations":"Forgot to render @Html.AntiForgeryToken() or asp-antiforgery=\"true\" on the form; renamed FormFieldName in options; AJAX POST sending JSON without the field; tag helper antiforgery disabled.","solutions":["Add @Html.AntiForgeryToken() (or asp-antiforgery-token) to the form.","Ensure options.FormFieldName matches the rendered hidden field name.","For AJAX/JSON requests, switch to header-based validation (set HeaderName) or include the field."],"exampleFix":"// before\n<form method=\"post\"> ... </form>\n\n// after\n<form method=\"post\">\n    @Html.AntiForgeryToken()\n    ...\n</form>","handlingStrategy":"try-catch","validationCode":"// C# - confirm the form field is present before validating\nif (httpContext.Request.HasFormContentType\n    && string.IsNullOrEmpty(httpContext.Request.Form[options.FormFieldName])) {\n    // render the field / return 400 instead of throwing\n}","typeGuard":null,"tryCatchPattern":"// C#\ntry {\n    await _antiforgery.ValidateRequestAsync(httpContext);\n} catch (AntiforgeryValidationException ex) {\n    // re-render form with @Html.AntiForgeryToken()\n}","preventionTips":["Render @Html.AntiForgeryToken() (or asp-antiforgery-token) on every validated form.","Keep options.FormFieldName in sync with the rendered hidden field.","For AJAX/JSON requests, switch to header-based validation or include the field."],"tags":["antiforgery","security","csrf","form","aspnetcore"],"analyzedSha":"294cab2f9b2e03af6b953820c7ab497c3c8b7ad9","analyzedAt":"2026-08-06T20:08:02.189Z","schemaVersion":2},"datasetVersion":"2026-08-06T23:17:07.152Z"}