{"record":{"id":"452b2d5b195aaf37","repo":"dotnet/aspnetcore","slug":"validation-of-the-provided-antiforgery-token-faile","errorCode":null,"errorMessage":"Validation of the provided antiforgery token failed. The cookie token and the request token were swapped.","messagePattern":"Validation of the provided antiforgery token failed\\. The cookie token and the request token were swapped\\.","errorType":"exception","errorClass":"AntiforgeryValidationException","httpStatus":null,"severity":"error","filePath":"src/Antiforgery/src/Internal/DefaultAntiforgery.cs","lineNumber":200,"sourceCode":"\n        // Extract cookie & request tokens\n        AntiforgeryToken deserializedCookieToken;\n        AntiforgeryToken deserializedRequestToken;\n\n        DeserializeTokens(\n            httpContext,\n            antiforgeryTokenSet,\n            out deserializedCookieToken,\n            out deserializedRequestToken);\n\n        // Validate\n        if (!_tokenGenerator.TryValidateTokenSet(\n            httpContext,\n            deserializedCookieToken,\n            deserializedRequestToken,\n            out var message))\n        {\n            throw new AntiforgeryValidationException(message);\n        }\n    }\n\n    /// <inheritdoc />\n    public void SetCookieTokenAndHeader(HttpContext httpContext)\n    {\n        ArgumentNullException.ThrowIfNull(httpContext);\n\n        CheckSSLConfig(httpContext);\n\n        var antiforgeryFeature = GetCookieTokens(httpContext);\n        if (!antiforgeryFeature.HaveStoredNewCookieToken && antiforgeryFeature.NewCookieToken != null)\n        {\n            if (antiforgeryFeature.NewCookieTokenString == null)\n            {\n                antiforgeryFeature.NewCookieTokenString =\n                    _tokenSerializer.Serialize(antiforgeryFeature.NewCookieToken);\n            }","sourceCodeStart":182,"sourceCodeEnd":218,"githubUrl":"https://github.com/dotnet/aspnetcore/blob/294cab2f9b2e03af6b953820c7ab497c3c8b7ad9/src/Antiforgery/src/Internal/DefaultAntiforgery.cs#L182-L218","documentation":"Thrown during token validation in TryValidateTokenSet when the cookie token and request token are in the wrong roles — the cookie token lacks IsCookieToken=true or the request token has IsCookieToken=true. The two tokens are a matched pair with different internal flags, and swapping them defeats the CSRF protection model so validation fails with AntiforgeryValidationException.","triggerScenarios":"The client or an intermediary put the request-token value into the antiforgery cookie and the cookie-token value into the form field/header. This is detected at DefaultAntiforgeryTokenGenerator.cs:129 when (!cookieToken.IsCookieToken || requestToken.IsCookieToken).","commonSituations":"Manual token management code that assigns the wrong token string to the cookie vs. the form field; a custom token store or proxy that rewrites the cookie from the request body; testing utilities that hard-code tokens in the wrong slots.","solutions":["Do not manually split or reassign token values; use IAntiforgery.GetAndStoreTokens which returns AntiforgeryTokenSet with correctly labeled CookieToken and RequestToken fields.","If writing custom token handling, ensure the CookieToken string goes only into the cookie and the RequestToken string goes only into the form field or header.","Delete stale/manually-set cookies and let GetAndStoreTokens regenerate a correct pair."],"exampleFix":"// before — tokens assigned backwards\nhttpContext.Response.Cookies.Append(\".AspNetCore.Antiforgery\", tokenSet.RequestToken);\n<input name=\"__RequestVerificationToken\" value=\"@tokenSet.CookieToken\" />\n\n// after — correct assignment\nhttpContext.Response.Cookies.Append(\".AspNetCore.Antiforgery\", tokenSet.CookieToken);\n<input name=\"__RequestVerificationToken\" value=\"@tokenSet.RequestToken\" />","handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":"try\n{\n    await _antiforgery.ValidateRequestAsync(HttpContext);\n}\ncatch (AntiforgeryValidationException ex) when (ex.Message.Contains(\"swapped\"))\n{\n    return BadRequest(\"Token mismatch — please reload the page.\");\n}","preventionTips":["Never manually assign token strings; always use AntiforgeryTokenSet.CookieToken for the cookie and AntiforgeryTokenSet.RequestToken for the form/header.","Use the built-in tag helpers or GetAndStoreTokens which label tokens correctly."],"tags":["antiforgery","security","csrf","token-validation"],"analyzedSha":"294cab2f9b2e03af6b953820c7ab497c3c8b7ad9","analyzedAt":"2026-08-06T20:08:02.189Z","schemaVersion":2},"datasetVersion":"2026-08-06T23:17:07.152Z"}