dotnet/aspnetcore · error · AntiforgeryValidationException

The required antiforgery cookie "{0}" is not present.

Error message

The required antiforgery cookie "{0}" is not present.

What it means

ValidateRequestAsync loads the request token set and requires a cookie token. If the antiforgery cookie (named per options.Cookie.Name) is absent, AntiforgeryValidationException is thrown. The cookie token is one half of the antiforgery token pair and must accompany every validated unsafe request.

Source

Thrown at src/Antiforgery/src/Internal/DefaultAntiforgery.cs:148

        else
        {
            _logger.ValidationFailed(message!);
        }

        return result;
    }

    /// <inheritdoc />
    public async Task ValidateRequestAsync(HttpContext httpContext)
    {
        ArgumentNullException.ThrowIfNull(httpContext);

        CheckSSLConfig(httpContext);

        var tokens = await _tokenStore.GetRequestTokensAsync(httpContext);
        if (tokens.CookieToken == null)
        {
            throw new AntiforgeryValidationException(
                Resources.FormatAntiforgery_CookieToken_MustBeProvided(_options.Cookie.Name));
        }

        if (tokens.RequestToken == null)
        {
            if (_options.HeaderName == null)
            {
                var message = Resources.FormatAntiforgery_FormToken_MustBeProvided(_options.FormFieldName);
                throw new AntiforgeryValidationException(message);
            }
            else if (!httpContext.Request.HasFormContentType)
            {
                var message = Resources.FormatAntiforgery_HeaderToken_MustBeProvided(_options.HeaderName);
                throw new AntiforgeryValidationException(message);
            }
            else
            {
                var message = Resources.FormatAntiforgery_RequestToken_MustBeProvided(

View on GitHub (pinned to 294cab2f9b)

Solutions

1. Ensure a GET (or GetAndStoreTokensAsync) runs first to set the antiforgery cookie before the POST.
2. Verify SameSite/Secure settings allow the cookie in the client/browser context.
3. Confirm options.Cookie.Name matches the cookie actually issued.
4. For API/non-browser clients, obtain the cookie token via GetAndStoreTokensAsync and send it with the request.

Example fix

// before: POST /form with no prior GET -> no antiforgery cookie

// after: GET /form first (sets cookie), then POST with cookie + field/header token

// C# - ensure the antiforgery cookie exists before validating
var tokens = await _tokenStore.GetRequestTokensAsync(httpContext);
if (tokens.CookieToken == null) {
    // issue tokens first (GET / GetAndStoreTokensAsync) instead of throwing
}

// C#
try {
    await _antiforgery.ValidateRequestAsync(httpContext);
} catch (AntiforgeryValidationException ex) {
    // return 400 / redirect to token-generating GET
}

When it happens

Trigger: Calling ValidateRequestAsync/ValidateAsync on a POST where the antiforgery cookie was never set (no prior token-generating GET), the browser blocked the cookie, or the configured cookie name does not match what was set.

Common situations: First POST without a prior GET to generate tokens; SameSite/Secure cookie rejected by the browser; cookie name customized on the server but not matching the cookie actually set; third-party cookie blocking; invoking antiforgery-protected endpoints from a non-browser client without supplying the cookie.

Related errors

• The required antiforgery form field "{0}" is not present.
• The required antiforgery header value "{0}" is not present.
• The required antiforgery request token was not provided in e
• Validation of the provided antiforgery token failed. The coo
• The antiforgery cookie token and request token do not match.

AI-assisted analysis of dotnet/aspnetcore@294cab2f9b (2026-08-06). Data as JSON: /api/errors/4742b82751d3917e. Report an issue: GitHub.