{"record":{"id":"f794677d97ae86ea","repo":"dotnet/aspnetcore","slug":"the-required-antiforgery-cookie-token-must-be-prov","errorCode":null,"errorMessage":"The required antiforgery cookie token must be provided.","messagePattern":"The required antiforgery cookie token must be provided\\.","errorType":"validation","errorClass":"ArgumentNullException","httpStatus":null,"severity":"error","filePath":"src/Antiforgery/src/Internal/DefaultAntiforgeryTokenGenerator.cs","lineNumber":116,"sourceCode":"\n    /// <inheritdoc />\n    public bool IsCookieTokenValid(AntiforgeryToken? cookieToken)\n    {\n        return cookieToken != null && cookieToken.IsCookieToken;\n    }\n\n    /// <inheritdoc />\n    public bool TryValidateTokenSet(\n        HttpContext httpContext,\n        AntiforgeryToken cookieToken,\n        AntiforgeryToken requestToken,\n        [NotNullWhen(false)] out string? message)\n    {\n        ArgumentNullException.ThrowIfNull(httpContext);\n\n        if (cookieToken == null)\n        {\n            throw new ArgumentNullException(\n                nameof(cookieToken),\n                Resources.Antiforgery_CookieToken_MustBeProvided_Generic);\n        }\n\n        if (requestToken == null)\n        {\n            throw new ArgumentNullException(\n                nameof(requestToken),\n                Resources.Antiforgery_RequestToken_MustBeProvided_Generic);\n        }\n\n        // Do the tokens have the correct format?\n        if (!cookieToken.IsCookieToken || requestToken.IsCookieToken)\n        {\n            message = Resources.AntiforgeryToken_TokensSwapped;\n            return false;\n        }\n","sourceCodeStart":98,"sourceCodeEnd":134,"githubUrl":"https://github.com/dotnet/aspnetcore/blob/294cab2f9b2e03af6b953820c7ab497c3c8b7ad9/src/Antiforgery/src/Internal/DefaultAntiforgeryTokenGenerator.cs#L98-L134","documentation":"Thrown by TryValidateTokenSet (DefaultAntiforgeryTokenGenerator.cs:114-119) when the cookieToken parameter passed to the validation method is null. This is an internal contract violation — by the time TryValidateTokenSet is called, the cookie token should have been deserialized from the request. The exception type is ArgumentNullException. This indicates a bug in the calling code or middleware, not a client-side data problem.","triggerScenarios":"TryValidateTokenSet is invoked with cookieToken == null. In normal operation, DefaultAntiforgery.ValidateTokens/DeserializeTokens guarantees non-null tokens before calling TryValidateTokenSet, so this only fires if custom code calls the generator directly with a null cookie token.","commonSituations":"Custom middleware or filter that calls IAntiforgeryTokenGenerator.TryValidateTokenSet directly without null-checking; a code path that bypasses DefaultAntiforgery's deserialization guards.","solutions":["Null-check the cookie token before calling TryValidateTokenSet.","Prefer using DefaultAntiforgery.ValidateRequestAsync or IsRequestValidAsync which handle token extraction and null checks internally."],"exampleFix":"// before — direct call without null check\n_tokenGenerator.TryValidateTokenSet(httpContext, maybeNullCookie, requestToken, out var msg);\n\n// after — null-check or use the public API\nif (cookieToken is null)\n    throw new AntiforgeryValidationException(\"Missing cookie token.\");\n_tokenGenerator.TryValidateTokenSet(httpContext, cookieToken, requestToken, out var msg);","handlingStrategy":"validation","validationCode":"// Null-check before calling TryValidateTokenSet\nif (cookieToken is null)\n    throw new AntiforgeryValidationException(\"Cookie token is required.\");","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use DefaultAntiforgery.ValidateRequestAsync instead of calling the generator directly.","Always null-check tokens extracted from the request before validation."],"tags":["antiforgery","security","programming-error","api-misuse","null-reference"],"analyzedSha":"294cab2f9b2e03af6b953820c7ab497c3c8b7ad9","analyzedAt":"2026-08-06T20:08:02.189Z","schemaVersion":2},"datasetVersion":"2026-08-06T23:17:07.152Z"}