dotnet/aspnetcore · error · AntiforgeryValidationException

The required antiforgery form field "{0}" is not present.

Error message

The required antiforgery form field "{0}" is not present.

What it means

When HeaderName is null (the default, meaning antiforgery uses a form field) and the request token is not found, the form field named per options.FormFieldName is required. Its absence throws AntiforgeryValidationException. This is the classic form-based antiforgery path.

Source

Thrown at src/Antiforgery/src/Internal/DefaultAntiforgery.cs:157

    public async Task ValidateRequestAsync(HttpContext httpContext)
    {
        ArgumentNullException.ThrowIfNull(httpContext);

        CheckSSLConfig(httpContext);

        var tokens = await _tokenStore.GetRequestTokensAsync(httpContext);
        if (tokens.CookieToken == null)
        {
            throw new AntiforgeryValidationException(
                Resources.FormatAntiforgery_CookieToken_MustBeProvided(_options.Cookie.Name));
        }

        if (tokens.RequestToken == null)
        {
            if (_options.HeaderName == null)
            {
                var message = Resources.FormatAntiforgery_FormToken_MustBeProvided(_options.FormFieldName);
                throw new AntiforgeryValidationException(message);
            }
            else if (!httpContext.Request.HasFormContentType)
            {
                var message = Resources.FormatAntiforgery_HeaderToken_MustBeProvided(_options.HeaderName);
                throw new AntiforgeryValidationException(message);
            }
            else
            {
                var message = Resources.FormatAntiforgery_RequestToken_MustBeProvided(
                    _options.FormFieldName,
                    _options.HeaderName);
                throw new AntiforgeryValidationException(message);
            }
        }

        ValidateTokens(httpContext, tokens);

        _logger.ValidatedAntiforgeryToken();

View on GitHub (pinned to 294cab2f9b)

Solutions

1. Add @Html.AntiForgeryToken() (or asp-antiforgery-token) to the form.
2. Ensure options.FormFieldName matches the rendered hidden field name.
3. For AJAX/JSON requests, switch to header-based validation (set HeaderName) or include the field.

Example fix

// before
<form method="post"> ... </form>

// after
<form method="post">
    @Html.AntiForgeryToken()
    ...
</form>

// C# - confirm the form field is present before validating
if (httpContext.Request.HasFormContentType
    && string.IsNullOrEmpty(httpContext.Request.Form[options.FormFieldName])) {
    // render the field / return 400 instead of throwing
}

// C#
try {
    await _antiforgery.ValidateRequestAsync(httpContext);
} catch (AntiforgeryValidationException ex) {
    // re-render form with @Html.AntiForgeryToken()
}

When it happens

Trigger: HeaderName is null and the submitted form body lacks the antiforgery field; the field name was customized and does not match; the field was stripped; the form was not actually submitted (e.g. AJAX JSON POST).

Common situations: Forgot to render @Html.AntiForgeryToken() or asp-antiforgery="true" on the form; renamed FormFieldName in options; AJAX POST sending JSON without the field; tag helper antiforgery disabled.

Related errors

• The required antiforgery cookie "{0}" is not present.
• The required antiforgery header value "{0}" is not present.
• The required antiforgery request token was not provided in e
• Validation of the provided antiforgery token failed. The coo
• The antiforgery cookie token and request token do not match.

AI-assisted analysis of dotnet/aspnetcore@294cab2f9b (2026-08-06). Data as JSON: /api/errors/2d2072a272979b62. Report an issue: GitHub.