{"action":"opened","issue":{"url":"https://api.github.com/repos/aspnet/Antiforgery/issues/5","labels_url":"https://api.github.com/repos/aspnet/Antiforgery/issues/5/labels{/name}","comments_url":"https://api.github.com/repos/aspnet/Antiforgery/issues/5/comments","events_url":"https://api.github.com/repos/aspnet/Antiforgery/issues/5/events","html_url":"https://github.com/aspnet/Antiforgery/issues/5","id":91090082,"number":5,"title":"Provide appropriate error message in case of missing antiforgery tokens","user":{"login":"rynowak","id":1430011,"avatar_url":"https://avatars.githubusercontent.com/u/1430011?v=3","gravatar_id":"","url":"https://api.github.com/users/rynowak","html_url":"https://github.com/rynowak","followers_url":"https://api.github.com/users/rynowak/followers","following_url":"https://api.github.com/users/rynowak/following{/other_user}","gists_url":"https://api.github.com/users/rynowak/gists{/gist_id}","starred_url":"https://api.github.com/users/rynowak/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rynowak/subscriptions","organizations_url":"https://api.github.com/users/rynowak/orgs","repos_url":"https://api.github.com/users/rynowak/repos","events_url":"https://api.github.com/users/rynowak/events{/privacy}","received_events_url":"https://api.github.com/users/rynowak/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-06-25T22:11:26Z","updated_at":"2015-06-25T22:11:26Z","closed_at":null,"body":"Moved from: https://github.com/aspnet/Mvc/issues/1210\r\n\r\n\r\nScenario as mentioned in below article:\r\nhttp://www.asp.net/web-api/overview/security/preventing-cross-site-request-forgery-(csrf)-attacks\r\n\r\nThe error message says `The required anti-forgery cookie \"__RequestVerificationToken\" is not present`...notice that it mentions the form field name here...\r\n\r\n```c#\r\nservices.AddSingleton<CustomAntiForgeryTokenFilter>();\r\n\r\n//---------------------------------\r\n\r\npublic class CustomAntiForgeryTokenFilter : IAuthorizationFilter\r\n{\r\n    private readonly AntiForgery _antiForgery;\r\n\r\n    public CustomAntiForgeryTokenFilter(AntiForgery antiForgery)\r\n    {\r\n        _antiForgery = antiForgery;\r\n    }\r\n\r\n    public void OnAuthorization(AuthorizationContext context)\r\n    {\r\n        string cookieToken = string.Empty;\r\n        string formToken = string.Empty;\r\n\r\n        string[] tokenHeaders;\r\n        if (context.HttpContext.Request.Headers.TryGetValue(\"RequestVerificationToken\", out tokenHeaders))\r\n        {\r\n            string[] tokens = tokenHeaders[0].Split(':');\r\n            cookieToken = tokens[0].Trim();\r\n            formToken = tokens[1].Trim();\r\n        }\r\n\r\n        _antiForgery.Validate(context.HttpContext, cookieToken, formToken);\r\n    }\r\n}\r\n\r\n//---------------------------------\r\n\r\n[ServiceFilter(typeof(CustomAntiForgeryTokenFilter), Order = 1)]\r\n[Authorize(Order = 2)]\r\npublic class ValuesController : Controller\r\n{\r\n    [HttpPost(\"api/values\")]\r\n    public Person Create([FromBody]Person data)\r\n    {\r\n\r\n        return data;\r\n    }\r\n}\r\n```\r\nError Message\r\n\r\n> <p class=\"errorInfo\">System.InvalidOperationException: The required anti-forgery cookie &quot;__RequestVerificationToken&quot; is not present.<br />   at Microsoft.AspNet.Mvc.TokenProvider.ValidateTokens(HttpContext httpContext, ClaimsIdentity identity, AntiForgeryToken sessionToken, AntiForgeryToken fieldToken)<br />   at Microsoft.AspNet.Mvc.AntiForgeryWorker.Validate(HttpContext httpContext, String cookieToken, String formToken)<br />   at Microsoft.AspNet.Mvc.AntiForgery.Validate(HttpContext context, String cookieToken, String formToken)<br />   at WebApplication10.CustomAntiForgeryTokenFilter.OnAuthorizationAsync(AuthorizationContext context) in C:\\Users\\kichalla\\Documents\\Visual Studio 14\\Projects\\WebApplication10\\src\\WebApplication10\\CustomAntiForgeryTokenFilterAttribute.cs:line 33<br />   at Microsoft.AspNet.Mvc.FilterActionInvoker.&lt;InvokeAuthorizationFilter&gt;d__1.MoveNext()<br />--- End of stack trace from previous location where exception was thrown ---<br />   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)<br />   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)<br />   at Microsoft.AspNet.Mvc.FilterActionInvoker.&lt;InvokeActionAuthorizationFilters&gt;d__1.MoveNext()<br />--- End of stack trace from previous location where exception was thrown ---<br />   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)<br />   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)<br />   at Microsoft.AspNet.Mvc.FilterActionInvoker.&lt;InvokeExceptionFilter&gt;d__1.MoveNext()<br />--- End of stack trace from previous location where exception was thrown ---<br />   at Microsoft.AspNet.Mvc.FilterActionInvoker.&lt;InvokeAsync&gt;d__1.MoveNext()<br />--- End of stack trace from previous location where exception was thrown ---<br />   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)<br />   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)<br />   at Microsoft.AspNet.Mvc.ReflectedActionInvoker.&lt;InvokeAsync&gt;d__1.MoveNext()<br />--- End of stack trace from previous location where exception was thrown ---<br />   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)<br />   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)<br />   at System.Runtime.CompilerServices.TaskAwaiter.ValidateEnd(Task task)<br />   at Microsoft.AspNet.Mvc.MvcRouteHandler.&lt;RouteAsync&gt;d__1.MoveNext()<br />--- End of stack trace from previous location where exception was thrown ---<br />   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)<br />   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)<br />   at Microsoft.AspNet.Routing.Template.TemplateRoute.&lt;RouteAsync&gt;d__1.MoveNext()<br />--- End of stack trace from previous location where exception was thrown ---<br />   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)<br />   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)<br />   at Microsoft.AspNet.Mvc.Routing.AttributeRoute.&lt;RouteAsync&gt;d__1.MoveNext()<br />--- End of stack trace from previous location where exception was thrown ---<br />   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)<br />   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)<br />   at Microsoft.AspNet.Routing.RouteCollection.&lt;RouteAsync&gt;d__1.MoveNext()<br />--- End of stack trace from previous location where exception was thrown ---<br />   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)<br />   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)<br />   at Microsoft.AspNet.Builder.RouterMiddleware.&lt;Invoke&gt;d__1.MoveNext()<br />--- End of stack trace from previous location where exception was thrown ---<br />   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)<br />   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)<br />   at Microsoft.AspNet.Security.Infrastructure.AuthenticationMiddleware`1.&lt;Invoke&gt;d__1.MoveNext()<br />--- End of stack trace from previous location where exception was thrown ---<br />   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)<br />   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)<br />   at Microsoft.AspNet.Security.Infrastructure.AuthenticationMiddleware`1.&lt;Invoke&gt;d__1.MoveNext()<br />--- End of stack trace from previous location where exception was thrown ---<br />   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)<br />   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)<br />   at Microsoft.AspNet.Security.Infrastructure.AuthenticationMiddleware`1.&lt;Invoke&gt;d__1.MoveNext()<br />--- End of stack trace from previous location where exception was thrown ---<br />   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)<br />   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)<br />   at Microsoft.AspNet.Security.Infrastructure.AuthenticationMiddleware`1.&lt;Invoke&gt;d__1.MoveNext()<br />--- End of stack trace from previous location where exception was thrown ---<br />   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)<br />   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)<br />   at Microsoft.AspNet.RequestContainer.ContainerMiddleware.&lt;Invoke&gt;d__1.MoveNext()<br />--- End of stack trace from previous location where exception was thrown ---<br />   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)<br />   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)<br />   at Microsoft.AspNet.Loader.IIS.KlrHttpApplication.&lt;ProcessRequestAsyncImpl&gt;d__1.MoveNext()<br />--- End of stack trace from previous location where exception was thrown ---<br />   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)<br />   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)<br />   at Microsoft.AspNet.Loader.IIS.HttpApplicationBase.&lt;InvokeProcessRequestAsyncImpl&gt;d__1.MoveNext()</p>"}}