dotnet/aspnetcore · error · InvalidOperationException

Unable to find the required services. Please add all the req

Error message

Unable to find the required services. Please add all the required services by calling 'IServiceCollection.AddAntiforgery' in the application startup code.

What it means

UseAntiforgery middleware (the .NET 9+ built-in antiforgery middleware) requires that the IAntiforgery service is registered in the DI container. Before wiring the middleware it probes ApplicationServices for IAntiforgery and throws this if absent, telling you to call AddAntiforgery in startup.

Source

Thrown at src/Antiforgery/src/AntiforgeryApplicationBuilderExtensions.cs:54

    /// </remarks>
    /// <param name="builder">The <see cref="IApplicationBuilder"/>.</param>
    /// <returns>The app builder.</returns>
    public static IApplicationBuilder UseAntiforgery(this IApplicationBuilder builder)
    {
        ArgumentNullException.ThrowIfNull(builder);
        builder.VerifyAntiforgeryServicesAreRegistered();

        builder.Properties[AntiforgeryMiddlewareSetKey] = true;
        builder.UseMiddleware<AntiforgeryMiddleware>();

        return builder;
    }

    private static void VerifyAntiforgeryServicesAreRegistered(this IApplicationBuilder builder)
    {
        if (builder.ApplicationServices.GetService(typeof(IAntiforgery)) == null)
        {
            throw new InvalidOperationException("Unable to find the required services. Please add all the required services by calling 'IServiceCollection.AddAntiforgery' in the application startup code.");
        }
    }
}

View on GitHub (pinned to 3600ca084e)

Solutions

1. Call builder.Services.AddAntiforgery() (or AddMvc/AddControllers/AddRazorPages) before app.Build()/UseAntiforgery().
2. Verify the registration is on the same IServiceCollection that builds the app pipeline.
3. If using AddControllers minimal setup, ensure AddControllers() (which registers antiforgery) runs before the middleware.

Example fix

// before
var app = builder.Build();
app.UseAntiforgery(); // throws - no service
// after
builder.Services.AddAntiforgery();
var app = builder.Build();
app.UseAntiforgery();

// Verify registration before building the pipeline
if (!builder.Services.Any(s => s.ServiceType == typeof(Microsoft.AspNetCore.Antiforgery.IAntiforgery))) {
    builder.Services.AddAntiforgery();
}

bool antiforgeryRegistered = builder.Services.Any(s => s.ServiceType == typeof(IAntiforgery));

try {
    app.UseAntiforgery();
} catch (InvalidOperationException ex) when (ex.Message.Contains("AddAntiforgery")) {
    builder.Services.AddAntiforgery(); // then rebuild app
    throw;
}

When it happens

Trigger: Calling builder.UseAntiforgery() (AntiforgeryApplicationBuilderExtensions.cs:39-48) when no service has registered IAntiforgery - i.e. AddAntiforgery(), AddMvc(), AddControllers(), or AddRazorPages() was not called on IServiceCollection beforehand.

Common situations: Minimal API or raw app that calls UseAntiforgery() but only added the antiforgery services conditionally or not at all; services registered after the middleware pipeline is built; moving to the new middleware from an older code path that implicitly registered services.

Related errors

• The required antiforgery cookie "{0}" is not present.
• At least one --target or --targets-file argument must be pro
• The required antiforgery form field "{0}" is not present.
• The required antiforgery header value "{0}" is not present.
• The required antiforgery request token was not provided in e

AI-assisted analysis of dotnet/aspnetcore@3600ca084e (2026-08-11). Data as JSON: /api/errors/8e41e0757ea4b6a4. Report an issue: GitHub.