dotnet/aspnetcore · error · AntiforgeryValidationException

The required antiforgery request token was not provided in e

Error message

The required antiforgery request token was not provided in either form field "{0}" or header value "{1}".

What it means

Thrown by DefaultAntiforgery.ValidateRequestAsync when no request token is found in the incoming POST. The system first checks the configured header (if HeaderName is set), then falls back to the form body field; when neither contains a token and the request has a form content type, this combined message is produced. It indicates the client sent a state-changing request without the antiforgery request token that pairs with the cookie token. The exception type is AntiforgeryValidationException.

Source

Thrown at src/Antiforgery/src/Internal/DefaultAntiforgery.cs:169

        if (tokens.RequestToken == null)
        {
            if (_options.HeaderName == null)
            {
                var message = Resources.FormatAntiforgery_FormToken_MustBeProvided(_options.FormFieldName);
                throw new AntiforgeryValidationException(message);
            }
            else if (!httpContext.Request.HasFormContentType)
            {
                var message = Resources.FormatAntiforgery_HeaderToken_MustBeProvided(_options.HeaderName);
                throw new AntiforgeryValidationException(message);
            }
            else
            {
                var message = Resources.FormatAntiforgery_RequestToken_MustBeProvided(
                    _options.FormFieldName,
                    _options.HeaderName);
                throw new AntiforgeryValidationException(message);
            }
        }

        ValidateTokens(httpContext, tokens);

        _logger.ValidatedAntiforgeryToken();
    }

    private void ValidateTokens(HttpContext httpContext, AntiforgeryTokenSet antiforgeryTokenSet)
    {
        Debug.Assert(!string.IsNullOrEmpty(antiforgeryTokenSet.CookieToken));
        Debug.Assert(!string.IsNullOrEmpty(antiforgeryTokenSet.RequestToken));

        // Extract cookie & request tokens
        AntiforgeryToken deserializedCookieToken;
        AntiforgeryToken deserializedRequestToken;

        DeserializeTokens(

View on GitHub (pinned to 294cab2f9b)

Solutions

1. Ensure the request includes the token: for forms use the asp-action tag helper which auto-renders a hidden <input name="__RequestVerificationToken">; for AJAX read the token emitted by IAntiforgery.GetAndStoreTokens and send it in the header named in AntiforgeryOptions.HeaderName.
2. Verify the form field name matches _options.FormFieldName (default "__RequestVerificationToken") and the header name matches _options.HeaderName.
3. If this is a JSON-body request, set HeaderName in AntiforgeryOptions and add the token as a request header from the client, since the form body won't be read for application/json.
4. Confirm the middleware pipeline includes AddAntiforgery/UseAntiforgery and that tokens were generated (GetAndStoreTokens) and sent to the client in the prior GET.

Example fix

// before (AJAX without token)
fetch('/api/save', { method: 'POST', body: JSON.stringify(data),
  headers: { 'Content-Type': 'application/json' } });

// after — send token in the configured header
const token = document.querySelector('input[name="__RequestVerificationToken"]').value;
fetch('/api/save', { method: 'POST', body: JSON.stringify(data),
  headers: { 'Content-Type': 'application/json',
             'RequestVerificationToken': token } });

// Ensure token is available before POSTing
function getAntiForgeryToken() {
  const input = document.querySelector('input[name="__RequestVerificationToken"]');
  if (!input || !input.value) {
    throw new Error('Antiforgery token missing from page');
  }
  return input.value;
}

try
{
    await _antiforgery.ValidateRequestAsync(HttpContext);
}
catch (AntiforgeryValidationException ex)
{
    _logger.LogWarning(ex, "Antiforgery validation failed");
    return BadRequest("Invalid or missing antiforgery token.");
}

When it happens

Trigger: A non-safe HTTP method (POST/PUT/DELETE/PATCH) is sent, the antiforgery cookie is present, but neither the configured header nor the form field (_options.FormFieldName, default "__RequestVerificationToken") contains a value. This branch fires specifically when _options.HeaderName is non-null AND the request HasFormContentType, yet the form field is empty.

Common situations: An AJAX/fetch POST that forgets to add the antiforgery header; a form rendered without the asp-antiforgery token tag helper; renaming the form field via AntiforgeryOptions.FormFieldName so the client sends the old name; a SPA sending JSON where the token is expected in a header but HeaderName was left null and the body is application/json (no form content type).

Related errors

• The required antiforgery cookie "{0}" is not present.
• The required antiforgery form field "{0}" is not present.
• The required antiforgery header value "{0}" is not present.
• Validation of the provided antiforgery token failed. The coo
• The antiforgery cookie token and request token do not match.

AI-assisted analysis of dotnet/aspnetcore@294cab2f9b (2026-08-06). Data as JSON: /api/errors/ead0bdca906c7cad. Report an issue: GitHub.