{"record":{"id":"4742b82751d3917e","repo":"dotnet/aspnetcore","slug":"the-required-antiforgery-cookie-0-is-not-prese","errorCode":null,"errorMessage":"The required antiforgery cookie \"{0}\" is not present.","messagePattern":"The required antiforgery cookie \"(.+?)\" is not present\\.","errorType":"exception","errorClass":"AntiforgeryValidationException","httpStatus":null,"severity":"error","filePath":"src/Antiforgery/src/Internal/DefaultAntiforgery.cs","lineNumber":148,"sourceCode":"        else\n        {\n            _logger.ValidationFailed(message!);\n        }\n\n        return result;\n    }\n\n    /// <inheritdoc />\n    public async Task ValidateRequestAsync(HttpContext httpContext)\n    {\n        ArgumentNullException.ThrowIfNull(httpContext);\n\n        CheckSSLConfig(httpContext);\n\n        var tokens = await _tokenStore.GetRequestTokensAsync(httpContext);\n        if (tokens.CookieToken == null)\n        {\n            throw new AntiforgeryValidationException(\n                Resources.FormatAntiforgery_CookieToken_MustBeProvided(_options.Cookie.Name));\n        }\n\n        if (tokens.RequestToken == null)\n        {\n            if (_options.HeaderName == null)\n            {\n                var message = Resources.FormatAntiforgery_FormToken_MustBeProvided(_options.FormFieldName);\n                throw new AntiforgeryValidationException(message);\n            }\n            else if (!httpContext.Request.HasFormContentType)\n            {\n                var message = Resources.FormatAntiforgery_HeaderToken_MustBeProvided(_options.HeaderName);\n                throw new AntiforgeryValidationException(message);\n            }\n            else\n            {\n                var message = Resources.FormatAntiforgery_RequestToken_MustBeProvided(","sourceCodeStart":130,"sourceCodeEnd":166,"githubUrl":"https://github.com/dotnet/aspnetcore/blob/294cab2f9b2e03af6b953820c7ab497c3c8b7ad9/src/Antiforgery/src/Internal/DefaultAntiforgery.cs#L130-L166","documentation":"ValidateRequestAsync loads the request token set and requires a cookie token. If the antiforgery cookie (named per options.Cookie.Name) is absent, AntiforgeryValidationException is thrown. The cookie token is one half of the antiforgery token pair and must accompany every validated unsafe request.","triggerScenarios":"Calling ValidateRequestAsync/ValidateAsync on a POST where the antiforgery cookie was never set (no prior token-generating GET), the browser blocked the cookie, or the configured cookie name does not match what was set.","commonSituations":"First POST without a prior GET to generate tokens; SameSite/Secure cookie rejected by the browser; cookie name customized on the server but not matching the cookie actually set; third-party cookie blocking; invoking antiforgery-protected endpoints from a non-browser client without supplying the cookie.","solutions":["Ensure a GET (or GetAndStoreTokensAsync) runs first to set the antiforgery cookie before the POST.","Verify SameSite/Secure settings allow the cookie in the client/browser context.","Confirm options.Cookie.Name matches the cookie actually issued.","For API/non-browser clients, obtain the cookie token via GetAndStoreTokensAsync and send it with the request."],"exampleFix":"// before: POST /form with no prior GET -> no antiforgery cookie\n\n// after: GET /form first (sets cookie), then POST with cookie + field/header token","handlingStrategy":"try-catch","validationCode":"// C# - ensure the antiforgery cookie exists before validating\nvar tokens = await _tokenStore.GetRequestTokensAsync(httpContext);\nif (tokens.CookieToken == null) {\n    // issue tokens first (GET / GetAndStoreTokensAsync) instead of throwing\n}","typeGuard":null,"tryCatchPattern":"// C#\ntry {\n    await _antiforgery.ValidateRequestAsync(httpContext);\n} catch (AntiforgeryValidationException ex) {\n    // return 400 / redirect to token-generating GET\n}","preventionTips":["Always issue the antiforgery cookie via a GET (or GetAndStoreTokensAsync) before a validated POST.","Match SameSite/Secure to the client so the cookie is actually stored.","Keep options.Cookie.Name consistent with the cookie you issue.","For non-browser clients, send the cookie obtained from GetAndStoreTokensAsync."],"tags":["antiforgery","security","csrf","aspnetcore"],"analyzedSha":"294cab2f9b2e03af6b953820c7ab497c3c8b7ad9","analyzedAt":"2026-08-06T20:08:02.189Z","schemaVersion":2},"datasetVersion":"2026-08-06T23:17:07.152Z"}