dotnet/aspnetcore · error · ArgumentException

The antiforgery cookie token is invalid.

Error message

The antiforgery cookie token is invalid.

What it means

Thrown by GenerateRequestToken (DefaultAntiforgeryTokenGenerator.cs:43-48) when the provided cookieToken fails IsCookieTokenValid — meaning it is null or has IsCookieToken != true. The request token must be derived from a valid cookie token (they share a SecurityToken), so an invalid cookie token is rejected with ArgumentException. This is a programming error, not a runtime data error.

Source

Thrown at src/Antiforgery/src/Internal/DefaultAntiforgeryTokenGenerator.cs:45

    {
        return new AntiforgeryToken()
        {
            // SecurityToken will be populated automatically.
            IsCookieToken = true
        };
    }

    /// <inheritdoc />
    public AntiforgeryToken GenerateRequestToken(
        HttpContext httpContext,
        AntiforgeryToken cookieToken)
    {
        ArgumentNullException.ThrowIfNull(httpContext);
        ArgumentNullException.ThrowIfNull(cookieToken);

        if (!IsCookieTokenValid(cookieToken))
        {
            throw new ArgumentException(
                Resources.Antiforgery_CookieToken_IsInvalid,
                nameof(cookieToken));
        }

        var requestToken = new AntiforgeryToken()
        {
            SecurityToken = cookieToken.SecurityToken,
            IsCookieToken = false
        };

        var isIdentityAuthenticated = false;

        // populate Username and ClaimUid
        var authenticatedIdentity = GetAuthenticatedIdentity(httpContext.User);
        if (authenticatedIdentity != null)
        {
            isIdentityAuthenticated = true;

View on GitHub (pinned to 294cab2f9b)

Solutions

1. Always generate or validate a cookie token first via GenerateCookieToken/IsCookieTokenValid before calling GenerateRequestToken.
2. If using DefaultAntiforgery directly, rely on GetAndStoreTokens/GetTokensInternal which handle cookie token generation internally.

Example fix

// before — passing null or wrong token type
var requestToken = _tokenGenerator.GenerateRequestToken(httpContext, maybeNullCookieToken);

// after — validate first
var cookieToken = _tokenGenerator.GenerateCookieToken();
if (!_tokenGenerator.IsCookieTokenValid(cookieToken)) throw new InvalidOperationException();
var requestToken = _tokenGenerator.GenerateRequestToken(httpContext, cookieToken);

// Validate before calling GenerateRequestToken
if (!_tokenGenerator.IsCookieTokenValid(cookieToken))
{
    cookieToken = _tokenGenerator.GenerateCookieToken();
}
var requestToken = _tokenGenerator.GenerateRequestToken(httpContext, cookieToken);

static bool IsValidCookieToken(AntiforgeryToken? token)
    => token is { IsCookieToken: true };

When it happens

Trigger: GenerateRequestToken is called with a null cookieToken or a token where IsCookieToken is false. IsCookieTokenValid returns true only when cookieToken != null && cookieToken.IsCookieToken.

Common situations: Custom code calling IAntiforgeryTokenGenerator.GenerateRequestToken with a request-token instead of a cookie-token; passing null because the cookie wasn't deserialized before calling; a deserialized token whose IsCookieToken flag was corrupted.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• The required antiforgery cookie token must be provided.
• The required antiforgery request token must be provided.
• The required antiforgery cookie "{0}" is not present.
• The required antiforgery form field "{0}" is not present.
• The required antiforgery header value "{0}" is not present.

AI-assisted analysis of dotnet/aspnetcore@294cab2f9b (2026-08-06). Data as JSON: /api/errors/dca5d006c383559b. Report an issue: GitHub.