163

I am using Membership.create user function, then the following error is occurring,

The required anti-forgery form field "__RequestVerificationToken" is not present

How can I fix this?

22 Answers 22

248

You have [ValidateAntiForgeryToken] attribute before your action. You also should add @Html.AntiForgeryToken() in your form.

7
  • 15
    I have a web page that has the same problem but the whole things are correct. whats the mistake. Aug 12, 2014 at 18:31
  • @ConductedClever You should carefully check everything (fields, cookies) with fiddler and/or firebug (any browser dev tools), look at this article: asp.net/web-api/overview/security/… Aug 13, 2014 at 13:49
  • @ConductedClever me too. That is work but rarely get this error and i don't have any idea WHY?
    – QMaster
    Dec 26, 2014 at 22:58
  • I have everything ok, in my tests it works, on a client's machine it worked until recently, but now it gives this error. I have no idea why. Does anybody have other ideas than the ones listed here please? Mar 15, 2017 at 9:51
  • 1
    Html.AntiForgeryToken(); does not work !! Turning into @Html.AntiForgeryToken() works May 9, 2018 at 12:25
91

In my case, I had this in my web.config:

<httpCookies requireSSL="true" />

But my project was set to not use SSL. Commenting out that line or setting up the project to always use SSL solved it.

2
  • 3
    In my case the web.config had requireSSL but there were IIS bindings for both port 80 and 443, so users typing https were getting correct behaviour and users typing http were getting this error, putting in a rewrite rule to force all to https://{HTTP_HOST}/{R:1} fixed it Mar 24, 2016 at 15:30
  • Thank you 😃 In my case in IIS there was this binding (https » EmptyHostName » IP » 443) but there was not a binding for (https » www.mysite.com » IP » 443). So I added a new binding with a non-empty host name for https that was equal to the domain and It solved the problem. I have rewrite settings in IIS to force http 2 https too. Dec 27, 2017 at 17:03
70

Like this:

The Controller

[HttpPost]
[ValidateAntiForgeryToken]
public ActionResult MethodName(FormCollection formCollection)
{
     ...
     Code Block
     ...
}

The View:

@using(Html.BeginForm())
{
     @Html.AntiForgeryToken()
     <input name="..." type="text" />
     // rest
}
1
43

Also make sure avoid not use [ValidateAntiForgeryToken] under [HttpGet].

  [HttpGet]
  public ActionResult MethodName()
  {
  ..
  }
2
  • 1
    This answer complemented the others and solved my problem! Thanks
    – Lucas
    Dec 3, 2015 at 16:39
  • 2
    This answer assumes you are not saving any submitted data (which you shouldn't be on an HttpGet). If you are, then you still need the XSRF protection that [ValidateAntiForgeryToken] provides.
    – thelem
    Feb 3, 2016 at 15:13
13

You will receive the error even when Cookies are not enabled.

2
  • 2
    Good hit. I was using Internet Explorer. Using Chrome browser solved the problem for me Mar 1, 2017 at 7:44
  • This solved my problem too. enabling cookies in google chrome. Thanks Feb 13, 2019 at 12:42
11

Another thing that can cause this (just ran into this) is the following: if you for some reason disable all your input fields in your form. it will disable the hidden input field that holds your verification token. when the form will be posted back the token value will be missing and will generate the error that it is missing. so what you need to do is to re-enable the input field that holds the verification token and all will be well.

1
  • That was my problem + solution. Thanks, great catch! May 2 at 18:10
10

In my case it was due to adding requireSSL=true to httpcookies in webconfig which made the AntiForgeryToken stop working. Example:

<system.web>
  <httpCookies httpOnlyCookies="true" requireSSL="true"/>
</system.web>

To make both requireSSL=true and @Html.AntiForgeryToken() work I added this line inside the Application_BeginRequest in Global.asax

    protected void Application_BeginRequest(object sender, EventArgs e)
  {
    AntiForgeryConfig.RequireSsl = HttpContext.Current.Request.IsSecureConnection;
  }
8

Another possibility for those of us uploading files as part of the request. If the content length exceeds <httpRuntime maxRequestLength="size in kilo bytes" /> and you're using request verification tokens, the browser displays the 'The required anti-forgery form field "__RequestVerificationToken" is not present' message instead of the request length exceeded message.

Setting maxRequestLength to a value large enough to cater for the request cures the immediate issue - though I'll admit it's not a proper solution (we want the user to know the true problem of file size, not that of request verification tokens missing).

7

In my case, I had this javascript on the form submit:

$('form').submit(function () {
    $('input').prop('disabled', true);
});

This was removing the hidden RequestVerificationToken from the form being submitted. I changed that to:

$('form').submit(function () {
    $('input[type=submit]').prop('disabled', true);
    $('input[type=text]').prop('readonly', true);
    $('input[type=password]').prop('readonly', true);
});

... and it worked fine.

2
  • How did you notice that anti key affected when you disabled inputs?
    – Cer
    Mar 16, 2017 at 5:57
  • 1
    @Cer - if you're asking how I noticed, I checked the request with fiddler and picked up that the key was not being sent. The I read that Html submits won't include disabled controls. So I changed it to readonly and excluded the hidden controls. Seems to work nicely.
    – Sean
    Mar 16, 2017 at 10:58
6

Make sure in your controller that you have your http attribute like:

[HttpPost]

also add the attribute in the controller:

[ValidateAntiForgeryToken]

In your form on your view you have to write:

@Html.AntiForgeryToken();

I had Html.AntiForgeryToken(); without the @ sign while it was in a code block, it didn't give an error in Razor but did at runtime. Make sure you look at the @ sign of @Html.Ant.. if it is missing or not

4

If anyone experiences the error for the same reason why I experience it, here's my solution:

if you had Html.AntiForgeryToken();

change it to @Html.AntiForgeryToken()

0
4

Got this error in Chrome with default login for ASP.NET with Individual User Accounts

.cshtml:

@using (Html.BeginForm("Login", "Account", new { ReturnUrl = ViewBag.ReturnUrl }, FormMethod.Post, new { @class = "form-horizontal", role = "form" }))
{
    @Html.AntiForgeryToken()
    <h4>Use a local account to log in.</h4>

Controller:

[HttpPost]
[AllowAnonymous]
[ValidateAntiForgeryToken]
public async Task<ActionResult> Login(LoginViewModel model, string returnUrl)

Solved by clearing site data for the site:

enter image description here

2
  • Ok its worked. But this happening again and again. In Firefox same project is running properly. What can I do?
    – Can Ürek
    Mar 16, 2020 at 21:29
  • @CanÜrek Do you have several different projects/sites with the same domain? Ex localhost, app.site.com and app2.site.com etc? It normally happens because of this.
    – Ogglas
    Mar 16, 2020 at 21:35
3

In my case incorrect domain in web.config for cookies was the reason:

<httpCookies domain=".wrong.domain.com" />
1
  • yeep! if you on local computer type <httpCookies domain="localhost" /> then only on local computer cookies will work and if you try to open your site on other machine you will enter it's ip (f.e. 192.168.1.43) that will not work becase it looking for "localhost" Feb 20, 2019 at 3:54
1

All the other answers in here are also valid, but if none of them solve the issue it is also worth checking that the actual headers are being passed to the server.

For example, in a load balanced environment behind nginx, the default configuration is to strip out the __RequestVerificationToken header before passing the request on to the server, see: simple nginx reverse proxy seems to strip some headers

0
0

In my EPiServer solution on several controllers there was a ContentOutputCache attribute on the Index action which accepted HttpGet. Each view for those actions contained a form which was posting to a HttpPost action to the same controller or to a different one. As soon as I removed that attribute from all of those Index actions problem was gone.

0

i'd like to share mine, i have been following this anti forgerytoken tutorial using asp.net mvc 4 with angularjs, but it throws an exception everytime i request using $http.post and i figured out the solution is just add 'X-Requested-With': 'XMLHttpRequest' to the headers of $http.post, because it seems like the (filterContext.HttpContext.Request.IsAjaxRequest()) does not recognize it as ajax and here is my example code.

App.js

var headers = { 'X-Requested-With': 'XMLHttpRequest', 'RequestVerificationToken': $scope.token, 'Content-Type': 'application/json; charset=utf-8;' };

$http({ method: 'POST', url: baseURL + 'Save/User', data: JSON.stringify($scope.formData), headers: headers }).then(function (values) { alert(values.data); }).catch(function (err) { console.log(err.data); });


SaveController

[HttpPost] [MyValidateAntiForgeryToken] public ActionResult User(UserModel usermodel) { ....

0

Because this comes up with the first search of this:

I had this issue only in Internet Explorer and couldnt figure out the what the issue was. Long story short it was not saving the cookie portion of the Token because our (sub)domain had an underscore in it. Worked in Chrome but IE/Edge didnt not like it.

0

Sometimes you are writing a form action method with a result list. In this case, you cannot work with one action method. So you have to have two action methods with the same name. One with [HttpGet] and another with [HttpPost] attribute.

In your [HttpPost] action method, set [ValidateAntiForgeryToken] attribute and also put @Html.AntiForgeryToken() in your html form.

0

In my case I was getting this error while making an AJAX post, it turned out to be that the __RequestVerificationToken value wasn't being passed across in the call. I had to manually find the value of this field and set this as a property on the data object that's sent to the endpoint.

i.e.

data.__RequestVerificationToken = $('input[name="__RequestVerificationToken"]').val();

Example

HTML

  <form id="myForm">
    @Html.AntiForgeryToken()

    <!-- other input fields -->

    <input type="submit" class="submitButton" value="Submit" />
  </form>

Javascript

$(document).on('click', '#myForm .submitButton', function () {
  var myData = { ... };
  myData.__RequestVerificationToken = $('#myForm input[name="__RequestVerificationToken"]').val();

  $.ajax({
    type: 'POST',
    url: myUrl,
    data: myData,
    contentType: 'application/x-www-form-urlencoded; charset=utf-8',
    dataType: 'json',
    success: function (response) {
      alert('Form submitted');
    },
    error: function (e) {
      console.error('Error submitting form', e);
      alert('Error submitting form');
    },
  });
  return false; //prevent form reload
});

Controller

[HttpPost]
[Route("myUrl")]
[ValidateAntiForgeryToken]
public async Task<ActionResult> MyUrlAsync(MyDto dto)
{
    ...
}
3
  • In fact if you ll define the structure of your MyDto class then it will be very helpful Jun 24, 2020 at 20:37
  • Well I'm not sure it will actually be very helpful and the example code is long gone now, so let's say public class MyDto { public bool Whatever { get; set; } } Jun 25, 2020 at 8:47
  • It all depends on how you preparing myData. If you are doing myData=$('myForm').serialize() it should work just fine. Aug 8, 2020 at 7:47
0

I have solved it this way

[AttributeUsage(AttributeTargets.Method)]
public class ExcludeFromAntiForgeryValidationAttribute : Attribute{
}

and place System.Web.Helpers.AntiForgery.Validate(cookie != null ? cookie.Value : null, formToken) in if condition

bool shouldValidate =!filterContext.ActionDescriptor.GetCustomAttributes(typeof(ExcludeFromAntiForgeryValidationAttribute), true).Any();
if (shouldValidate){
    System.Web.Helpers.AntiForgery.Validate(cookie != null ? cookie.Value : null, formToken);
}
0

For me it was a missleading error related to asp.net and the limit on the request body size. I was happening only when trying to submit files more than 4MB. Adding explicitely the desired size in the web.config resolved the error:

<httpRuntime targetFramework="4.7.1" maxRequestLength="10096" />

ASP.NET Request Limits: http://msdn.microsoft.com/en-us/library/e1f13641.aspx IIS Request Limits: http://www.iis.net/ConfigReference/system.webServer/security/requestFiltering/requestLimits

-1

If you want to use [ValidateAntiForgeryToken] on a method you should just add @Html.AntiForgeryToken() to the form which is using the method mentioned.

If you have the method with the same name of the View(which has the form with @Html.AntiForgeryToken() ) then you should have two overloaded method in the controller.

Something like this:

First-> for the ActionResult for the view

[AllowAnonymous]
public ActionResult PasswordChange()
{
   PasswordChangeViewModel passwordChangeViewModel = new PasswordChangeViewModel();
   return View(passwordChangeViewModel);
}

Second-> for the HttpPost method

[HttpPost]
[AllowAnonymous]
[ValidateAntiForgeryToken]
public ActionResult PasswordChange(PasswordChangeViewModel passwordChangeViewModel)
{
   //some code
} 

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.