{"record":{"id":"c9b19f34dbff51ce","repo":"dotnet/aspnetcore","slug":"the-required-antiforgery-request-token-must-be-pro","errorCode":null,"errorMessage":"The required antiforgery request token must be provided.","messagePattern":"The required antiforgery request token must be provided\\.","errorType":"validation","errorClass":"ArgumentNullException","httpStatus":null,"severity":"error","filePath":"src/Antiforgery/src/Internal/DefaultAntiforgeryTokenGenerator.cs","lineNumber":123,"sourceCode":"    /// <inheritdoc />\n    public bool TryValidateTokenSet(\n        HttpContext httpContext,\n        AntiforgeryToken cookieToken,\n        AntiforgeryToken requestToken,\n        [NotNullWhen(false)] out string? message)\n    {\n        ArgumentNullException.ThrowIfNull(httpContext);\n\n        if (cookieToken == null)\n        {\n            throw new ArgumentNullException(\n                nameof(cookieToken),\n                Resources.Antiforgery_CookieToken_MustBeProvided_Generic);\n        }\n\n        if (requestToken == null)\n        {\n            throw new ArgumentNullException(\n                nameof(requestToken),\n                Resources.Antiforgery_RequestToken_MustBeProvided_Generic);\n        }\n\n        // Do the tokens have the correct format?\n        if (!cookieToken.IsCookieToken || requestToken.IsCookieToken)\n        {\n            message = Resources.AntiforgeryToken_TokensSwapped;\n            return false;\n        }\n\n        // Are the security tokens embedded in each incoming token identical?\n        if (!object.Equals(cookieToken.SecurityToken, requestToken.SecurityToken))\n        {\n            message = Resources.AntiforgeryToken_SecurityTokenMismatch;\n            return false;\n        }\n","sourceCodeStart":105,"sourceCodeEnd":141,"githubUrl":"https://github.com/dotnet/aspnetcore/blob/294cab2f9b2e03af6b953820c7ab497c3c8b7ad9/src/Antiforgery/src/Internal/DefaultAntiforgeryTokenGenerator.cs#L105-L141","documentation":"Thrown by TryValidateTokenSet (DefaultAntiforgeryTokenGenerator.cs:121-126) when the requestToken parameter is null. Like the cookie-token null check, this is an internal contract violation — the request token must be deserialized from the incoming request before validation. The exception type is ArgumentNullException.","triggerScenarios":"TryValidateTokenSet is invoked with requestToken == null. In normal flow, DefaultAntiforgery checks for null tokens before calling TryValidateTokenSet (DefaultAntiforgery.cs:146-170 throws AntiforgeryValidationException with user-facing messages), so this only fires from custom code calling the generator directly.","commonSituations":"Custom antiforgery filter or middleware calling TryValidateTokenSet without verifying the request token was present and deserialized.","solutions":["Ensure the request token is deserialized and non-null before calling TryValidateTokenSet.","Use DefaultAntiforgery.ValidateRequestAsync which produces user-facing error messages instead of ArgumentNullException for missing tokens."],"exampleFix":"// before — calling generator without checking request token\n_tokenGenerator.TryValidateTokenSet(httpContext, cookieToken, maybeNullRequest, out var msg);\n\n// after — use the public API that handles nulls gracefully\nawait _antiforgery.ValidateRequestAsync(httpContext);","handlingStrategy":"validation","validationCode":"// Null-check before calling TryValidateTokenSet\nif (requestToken is null)\n    throw new AntiforgeryValidationException(\"Request token is required.\");","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use DefaultAntiforgery.ValidateRequestAsync which handles missing tokens with user-facing errors.","Null-check all deserialized tokens before calling the generator."],"tags":["antiforgery","security","programming-error","api-misuse","null-reference"],"analyzedSha":"294cab2f9b2e03af6b953820c7ab497c3c8b7ad9","analyzedAt":"2026-08-06T20:08:02.189Z","schemaVersion":2},"datasetVersion":"2026-08-06T23:17:07.152Z"}