dotnet/aspnetcore · error · ArgumentNullException

The required antiforgery cookie token must be provided.

Error message

The required antiforgery cookie token must be provided.

What it means

Thrown by TryValidateTokenSet (DefaultAntiforgeryTokenGenerator.cs:114-119) when the cookieToken parameter passed to the validation method is null. This is an internal contract violation — by the time TryValidateTokenSet is called, the cookie token should have been deserialized from the request. The exception type is ArgumentNullException. This indicates a bug in the calling code or middleware, not a client-side data problem.

Source

Thrown at src/Antiforgery/src/Internal/DefaultAntiforgeryTokenGenerator.cs:116

    /// <inheritdoc />
    public bool IsCookieTokenValid(AntiforgeryToken? cookieToken)
    {
        return cookieToken != null && cookieToken.IsCookieToken;
    }

    /// <inheritdoc />
    public bool TryValidateTokenSet(
        HttpContext httpContext,
        AntiforgeryToken cookieToken,
        AntiforgeryToken requestToken,
        [NotNullWhen(false)] out string? message)
    {
        ArgumentNullException.ThrowIfNull(httpContext);

        if (cookieToken == null)
        {
            throw new ArgumentNullException(
                nameof(cookieToken),
                Resources.Antiforgery_CookieToken_MustBeProvided_Generic);
        }

        if (requestToken == null)
        {
            throw new ArgumentNullException(
                nameof(requestToken),
                Resources.Antiforgery_RequestToken_MustBeProvided_Generic);
        }

        // Do the tokens have the correct format?
        if (!cookieToken.IsCookieToken || requestToken.IsCookieToken)
        {
            message = Resources.AntiforgeryToken_TokensSwapped;
            return false;
        }

View on GitHub (pinned to 294cab2f9b)

Solutions

1. Null-check the cookie token before calling TryValidateTokenSet.
2. Prefer using DefaultAntiforgery.ValidateRequestAsync or IsRequestValidAsync which handle token extraction and null checks internally.

Example fix

// before — direct call without null check
_tokenGenerator.TryValidateTokenSet(httpContext, maybeNullCookie, requestToken, out var msg);

// after — null-check or use the public API
if (cookieToken is null)
    throw new AntiforgeryValidationException("Missing cookie token.");
_tokenGenerator.TryValidateTokenSet(httpContext, cookieToken, requestToken, out var msg);

// Null-check before calling TryValidateTokenSet
if (cookieToken is null)
    throw new AntiforgeryValidationException("Cookie token is required.");

When it happens

Trigger: TryValidateTokenSet is invoked with cookieToken == null. In normal operation, DefaultAntiforgery.ValidateTokens/DeserializeTokens guarantees non-null tokens before calling TryValidateTokenSet, so this only fires if custom code calls the generator directly with a null cookie token.

Common situations: Custom middleware or filter that calls IAntiforgeryTokenGenerator.TryValidateTokenSet directly without null-checking; a code path that bypasses DefaultAntiforgery's deserialization guards.

Related errors

• The required antiforgery request token must be provided.
• The antiforgery cookie token is invalid.
• The required antiforgery cookie "{0}" is not present.
• The required antiforgery form field "{0}" is not present.
• The required antiforgery header value "{0}" is not present.

AI-assisted analysis of dotnet/aspnetcore@294cab2f9b (2026-08-06). Data as JSON: /api/errors/f794677d97ae86ea. Report an issue: GitHub.