dotnet/aspnetcore · error · ArgumentNullException

The required antiforgery request token must be provided.

Error message

The required antiforgery request token must be provided.

What it means

Thrown by TryValidateTokenSet (DefaultAntiforgeryTokenGenerator.cs:121-126) when the requestToken parameter is null. Like the cookie-token null check, this is an internal contract violation — the request token must be deserialized from the incoming request before validation. The exception type is ArgumentNullException.

Source

Thrown at src/Antiforgery/src/Internal/DefaultAntiforgeryTokenGenerator.cs:123

    /// <inheritdoc />
    public bool TryValidateTokenSet(
        HttpContext httpContext,
        AntiforgeryToken cookieToken,
        AntiforgeryToken requestToken,
        [NotNullWhen(false)] out string? message)
    {
        ArgumentNullException.ThrowIfNull(httpContext);

        if (cookieToken == null)
        {
            throw new ArgumentNullException(
                nameof(cookieToken),
                Resources.Antiforgery_CookieToken_MustBeProvided_Generic);
        }

        if (requestToken == null)
        {
            throw new ArgumentNullException(
                nameof(requestToken),
                Resources.Antiforgery_RequestToken_MustBeProvided_Generic);
        }

        // Do the tokens have the correct format?
        if (!cookieToken.IsCookieToken || requestToken.IsCookieToken)
        {
            message = Resources.AntiforgeryToken_TokensSwapped;
            return false;
        }

        // Are the security tokens embedded in each incoming token identical?
        if (!object.Equals(cookieToken.SecurityToken, requestToken.SecurityToken))
        {
            message = Resources.AntiforgeryToken_SecurityTokenMismatch;
            return false;
        }

View on GitHub (pinned to 294cab2f9b)

Solutions

1. Ensure the request token is deserialized and non-null before calling TryValidateTokenSet.
2. Use DefaultAntiforgery.ValidateRequestAsync which produces user-facing error messages instead of ArgumentNullException for missing tokens.

Example fix

// before — calling generator without checking request token
_tokenGenerator.TryValidateTokenSet(httpContext, cookieToken, maybeNullRequest, out var msg);

// after — use the public API that handles nulls gracefully
await _antiforgery.ValidateRequestAsync(httpContext);

// Null-check before calling TryValidateTokenSet
if (requestToken is null)
    throw new AntiforgeryValidationException("Request token is required.");

When it happens

Trigger: TryValidateTokenSet is invoked with requestToken == null. In normal flow, DefaultAntiforgery checks for null tokens before calling TryValidateTokenSet (DefaultAntiforgery.cs:146-170 throws AntiforgeryValidationException with user-facing messages), so this only fires from custom code calling the generator directly.

Common situations: Custom antiforgery filter or middleware calling TryValidateTokenSet without verifying the request token was present and deserialized.

Related errors

• The required antiforgery cookie token must be provided.
• The antiforgery cookie token is invalid.
• The required antiforgery cookie "{0}" is not present.
• The required antiforgery form field "{0}" is not present.
• The required antiforgery header value "{0}" is not present.

AI-assisted analysis of dotnet/aspnetcore@294cab2f9b (2026-08-06). Data as JSON: /api/errors/c9b19f34dbff51ce. Report an issue: GitHub.