Occasional __RequestVerificationToken errors

Question

I've got an MVC web app on azure, and a couple of hundred times a day, I get an The required anti-forgery cookie "__RequestVerificationToken" is not present. in my unhandled exceptions logs.

I've set everything up correctly, my action method has the [ValidateAntiForgeryToken].

I can see from looking at the exception details that the token was present in the form, but the cookie was not present.

Anyone know what might cause this?

Here's the error in full.

System.Web.Mvc.HttpAntiForgeryException (0x80004005): The required anti-forgery cookie "__RequestVerificationToken" is not present.
   at System.Web.Helpers.AntiXsrf.TokenValidator.ValidateTokens(HttpContextBase httpContext, IIdentity identity, AntiForgeryToken sessionToken, AntiForgeryToken fieldToken)
   at System.Web.Helpers.AntiXsrf.AntiForgeryWorker.Validate(HttpContextBase httpContext)
   at System.Web.Helpers.AntiForgery.Validate()

Answer 1

This can be caused by many issues. Things that can cause the issue:

• Bots or clients without enabled cookies
• Too many cookies being created on client (there is only so many cookies browser can handle per domain) and AntiForgeryCookie ends up being removed