{"record":{"id":"2f81724150cdcd4d","repo":"dotnet/aspnetcore","slug":"the-provided-antiforgery-token-failed-a-custom-dat","errorCode":null,"errorMessage":"The provided antiforgery token failed a custom data check.","messagePattern":"The provided antiforgery token failed a custom data check\\.","errorType":"exception","errorClass":"AntiforgeryValidationException","httpStatus":null,"severity":"error","filePath":"src/Antiforgery/src/Internal/DefaultAntiforgery.cs","lineNumber":200,"sourceCode":"\n        // Extract cookie & request tokens\n        AntiforgeryToken deserializedCookieToken;\n        AntiforgeryToken deserializedRequestToken;\n\n        DeserializeTokens(\n            httpContext,\n            antiforgeryTokenSet,\n            out deserializedCookieToken,\n            out deserializedRequestToken);\n\n        // Validate\n        if (!_tokenGenerator.TryValidateTokenSet(\n            httpContext,\n            deserializedCookieToken,\n            deserializedRequestToken,\n            out var message))\n        {\n            throw new AntiforgeryValidationException(message);\n        }\n    }\n\n    /// <inheritdoc />\n    public void SetCookieTokenAndHeader(HttpContext httpContext)\n    {\n        ArgumentNullException.ThrowIfNull(httpContext);\n\n        CheckSSLConfig(httpContext);\n\n        var antiforgeryFeature = GetCookieTokens(httpContext);\n        if (!antiforgeryFeature.HaveStoredNewCookieToken && antiforgeryFeature.NewCookieToken != null)\n        {\n            if (antiforgeryFeature.NewCookieTokenString == null)\n            {\n                antiforgeryFeature.NewCookieTokenString =\n                    _tokenSerializer.Serialize(antiforgeryFeature.NewCookieToken);\n            }","sourceCodeStart":182,"sourceCodeEnd":218,"githubUrl":"https://github.com/dotnet/aspnetcore/blob/294cab2f9b2e03af6b953820c7ab497c3c8b7ad9/src/Antiforgery/src/Internal/DefaultAntiforgery.cs#L182-L218","documentation":"Thrown during TryValidateTokenSet when a registered IAntiforgeryAdditionalDataProvider's ValidateAdditionalData method returns false. The additional data provider is an extensibility hook allowing applications to embed and verify custom data (e.g., a session ID) inside the request token; when that custom check fails, validation is rejected. Produced by Resources.AntiforgeryToken_AdditionalDataCheckFailed at DefaultAntiforgeryTokenGenerator.cs:189.","triggerScenarios":"_additionalDataProvider is non-null and ValidateAdditionalData(httpContext, requestToken.AdditionalData) returns false. This is application-specific logic implemented via IAntiforgeryAdditionalDataProvider.","commonSituations":"A custom additional-data provider validates a session ID or tenant ID embedded in the token; the session expired or changed; the token was generated for a different session/tenant; the provider's validation logic changed and now rejects previously-valid tokens.","solutions":["Review the custom IAntiforgeryAdditionalDataProvider.ValidateAdditionalData implementation to understand what condition failed.","Ensure the data returned by GetAdditionalData at token generation time is consistent with what ValidateAdditionalData expects at validation time.","Regenerate tokens (GetAndStoreTokens) after the underlying data (session/tenant) changes."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try\n{\n    await _antiforgery.ValidateRequestAsync(HttpContext);\n}\ncatch (AntiforgeryValidationException ex) when (ex.Message.Contains(\"custom data check\"))\n{\n    _logger.LogWarning(\"Additional data validation failed: {Msg}\", ex.Message);\n    return BadRequest(\"Session validation failed.\");\n}","preventionTips":["Keep GetAdditionalData and ValidateAdditionalData logic consistent and symmetric.","Regenerate tokens after the underlying data (session/tenant) changes."],"tags":["antiforgery","security","csrf","extensibility","custom-validation"],"analyzedSha":"294cab2f9b2e03af6b953820c7ab497c3c8b7ad9","analyzedAt":"2026-08-06T20:08:02.189Z","schemaVersion":2},"datasetVersion":"2026-08-06T23:17:07.152Z"}