dotnet/aspnetcore · error · AntiforgeryValidationException

The provided antiforgery token failed a custom data check.

Error message

The provided antiforgery token failed a custom data check.

What it means

Thrown during TryValidateTokenSet when a registered IAntiforgeryAdditionalDataProvider's ValidateAdditionalData method returns false. The additional data provider is an extensibility hook allowing applications to embed and verify custom data (e.g., a session ID) inside the request token; when that custom check fails, validation is rejected. Produced by Resources.AntiforgeryToken_AdditionalDataCheckFailed at DefaultAntiforgeryTokenGenerator.cs:189.

Source

Thrown at src/Antiforgery/src/Internal/DefaultAntiforgery.cs:200

        // Extract cookie & request tokens
        AntiforgeryToken deserializedCookieToken;
        AntiforgeryToken deserializedRequestToken;

        DeserializeTokens(
            httpContext,
            antiforgeryTokenSet,
            out deserializedCookieToken,
            out deserializedRequestToken);

        // Validate
        if (!_tokenGenerator.TryValidateTokenSet(
            httpContext,
            deserializedCookieToken,
            deserializedRequestToken,
            out var message))
        {
            throw new AntiforgeryValidationException(message);
        }
    }

    /// <inheritdoc />
    public void SetCookieTokenAndHeader(HttpContext httpContext)
    {
        ArgumentNullException.ThrowIfNull(httpContext);

        CheckSSLConfig(httpContext);

        var antiforgeryFeature = GetCookieTokens(httpContext);
        if (!antiforgeryFeature.HaveStoredNewCookieToken && antiforgeryFeature.NewCookieToken != null)
        {
            if (antiforgeryFeature.NewCookieTokenString == null)
            {
                antiforgeryFeature.NewCookieTokenString =
                    _tokenSerializer.Serialize(antiforgeryFeature.NewCookieToken);
            }

View on GitHub (pinned to 294cab2f9b)

Solutions

1. Review the custom IAntiforgeryAdditionalDataProvider.ValidateAdditionalData implementation to understand what condition failed.
2. Ensure the data returned by GetAdditionalData at token generation time is consistent with what ValidateAdditionalData expects at validation time.
3. Regenerate tokens (GetAndStoreTokens) after the underlying data (session/tenant) changes.

try
{
    await _antiforgery.ValidateRequestAsync(HttpContext);
}
catch (AntiforgeryValidationException ex) when (ex.Message.Contains("custom data check"))
{
    _logger.LogWarning("Additional data validation failed: {Msg}", ex.Message);
    return BadRequest("Session validation failed.");
}

When it happens

Trigger: _additionalDataProvider is non-null and ValidateAdditionalData(httpContext, requestToken.AdditionalData) returns false. This is application-specific logic implemented via IAntiforgeryAdditionalDataProvider.

Common situations: A custom additional-data provider validates a session ID or tenant ID embedded in the token; the session expired or changed; the token was generated for a different session/tenant; the provider's validation logic changed and now rejects previously-valid tokens.

Related errors

• The required antiforgery cookie "{0}" is not present.
• The required antiforgery form field "{0}" is not present.
• The required antiforgery header value "{0}" is not present.
• The required antiforgery request token was not provided in e
• Validation of the provided antiforgery token failed. The coo

AI-assisted analysis of dotnet/aspnetcore@294cab2f9b (2026-08-06). Data as JSON: /api/errors/2f81724150cdcd4d. Report an issue: GitHub.