{"record":{"id":"dca5d006c383559b","repo":"dotnet/aspnetcore","slug":"the-antiforgery-cookie-token-is-invalid","errorCode":null,"errorMessage":"The antiforgery cookie token is invalid.","messagePattern":"The antiforgery cookie token is invalid\\.","errorType":"validation","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"src/Antiforgery/src/Internal/DefaultAntiforgeryTokenGenerator.cs","lineNumber":45,"sourceCode":"    {\n        return new AntiforgeryToken()\n        {\n            // SecurityToken will be populated automatically.\n            IsCookieToken = true\n        };\n    }\n\n    /// <inheritdoc />\n    public AntiforgeryToken GenerateRequestToken(\n        HttpContext httpContext,\n        AntiforgeryToken cookieToken)\n    {\n        ArgumentNullException.ThrowIfNull(httpContext);\n        ArgumentNullException.ThrowIfNull(cookieToken);\n\n        if (!IsCookieTokenValid(cookieToken))\n        {\n            throw new ArgumentException(\n                Resources.Antiforgery_CookieToken_IsInvalid,\n                nameof(cookieToken));\n        }\n\n        var requestToken = new AntiforgeryToken()\n        {\n            SecurityToken = cookieToken.SecurityToken,\n            IsCookieToken = false\n        };\n\n        var isIdentityAuthenticated = false;\n\n        // populate Username and ClaimUid\n        var authenticatedIdentity = GetAuthenticatedIdentity(httpContext.User);\n        if (authenticatedIdentity != null)\n        {\n            isIdentityAuthenticated = true;\n","sourceCodeStart":27,"sourceCodeEnd":63,"githubUrl":"https://github.com/dotnet/aspnetcore/blob/294cab2f9b2e03af6b953820c7ab497c3c8b7ad9/src/Antiforgery/src/Internal/DefaultAntiforgeryTokenGenerator.cs#L27-L63","documentation":"Thrown by GenerateRequestToken (DefaultAntiforgeryTokenGenerator.cs:43-48) when the provided cookieToken fails IsCookieTokenValid — meaning it is null or has IsCookieToken != true. The request token must be derived from a valid cookie token (they share a SecurityToken), so an invalid cookie token is rejected with ArgumentException. This is a programming error, not a runtime data error.","triggerScenarios":"GenerateRequestToken is called with a null cookieToken or a token where IsCookieToken is false. IsCookieTokenValid returns true only when cookieToken != null && cookieToken.IsCookieToken.","commonSituations":"Custom code calling IAntiforgeryTokenGenerator.GenerateRequestToken with a request-token instead of a cookie-token; passing null because the cookie wasn't deserialized before calling; a deserialized token whose IsCookieToken flag was corrupted.","solutions":["Always generate or validate a cookie token first via GenerateCookieToken/IsCookieTokenValid before calling GenerateRequestToken.","If using DefaultAntiforgery directly, rely on GetAndStoreTokens/GetTokensInternal which handle cookie token generation internally."],"exampleFix":"// before — passing null or wrong token type\nvar requestToken = _tokenGenerator.GenerateRequestToken(httpContext, maybeNullCookieToken);\n\n// after — validate first\nvar cookieToken = _tokenGenerator.GenerateCookieToken();\nif (!_tokenGenerator.IsCookieTokenValid(cookieToken)) throw new InvalidOperationException();\nvar requestToken = _tokenGenerator.GenerateRequestToken(httpContext, cookieToken);","handlingStrategy":"validation","validationCode":"// Validate before calling GenerateRequestToken\nif (!_tokenGenerator.IsCookieTokenValid(cookieToken))\n{\n    cookieToken = _tokenGenerator.GenerateCookieToken();\n}\nvar requestToken = _tokenGenerator.GenerateRequestToken(httpContext, cookieToken);","typeGuard":"static bool IsValidCookieToken(AntiforgeryToken? token)\n    => token is { IsCookieToken: true };","tryCatchPattern":null,"preventionTips":["Always call IsCookieTokenValid before GenerateRequestToken.","Prefer the public IAntiforgery API which handles cookie-token lifecycle internally."],"tags":["antiforgery","security","programming-error","api-misuse"],"analyzedSha":"294cab2f9b2e03af6b953820c7ab497c3c8b7ad9","analyzedAt":"2026-08-06T20:08:02.189Z","schemaVersion":2},"datasetVersion":"2026-08-06T23:17:07.152Z"}