What is the .AspNetCore.Antiforgery. cookie?
.AspNetCore.Antiforgery. is a cookie name prefix used by Microsoft's ASP.NET Core framework (modern versions, 3.x and later). The full name also includes a unique identifier generated by the application, so the suffix value differs between installations.
The cookie is set automatically by the server, not by a third-party script, whenever the web application uses ASP.NET Core's built-in anti-forgery (anti-CSRF) system. It typically appears when a visitor loads a page containing a form (login, contact, checkout, admin panel) generated with ASP.NET Core's helper functions.
What data it stores
The cookie stores a unique cryptographic token used to verify the authenticity of requests submitted via forms (POST). The value is an encrypted/encoded string generated by the server; the exact internal format is not relevant to the visitor and can vary depending on the application's configuration.
The data stays on the server hosting that ASP.NET Core application — the cookie is not sent to third parties and has no connection to advertising or analytics networks.
What it is used for
The cookie's role is purely security-related: it prevents cross-site request forgery attacks, where a malicious site could submit unauthorized requests on behalf of an authenticated user (for example, changing a password or placing an order without the user's knowledge).
For the site owner, this cookie is part of the correct and secure operation of forms, generated automatically by the framework without extra configuration from the developer.
Does it require consent?
- Category: strictly necessary (required for the site to function).
- Under Law 506/2004 (transposing the ePrivacy Directive) and GDPR guidance, cookies strictly necessary for the security of a service explicitly requested by the user do not require prior consent.
- The site owner should still list it in the cookie policy, stating its purpose, duration (session), and provider (ASP.NET Core / the site's own application), for transparency toward visitors.
How to block or delete .AspNetCore.Antiforgery.
A visitor can delete or block this cookie from browser settings (for example, the cookies and site data section in Chrome, Firefox, Edge, or Safari), either globally or just for that domain. Blocking it, however, can prevent forms on the site from submitting correctly, causing errors such as a rejected request or invalid session.
Because it is strictly necessary, a CMP like CookieFix should not block this cookie before consent — it is exempt from the automatic blocking applied to statistics or marketing scripts, precisely so the site's forms keep working.
Frequently asked questions
It's a security cookie automatically generated by the ASP.NET Core framework to protect the site's forms against CSRF attacks.
No, it does not track the user and is not used for advertising; its role is strictly technical, protecting requests submitted via forms.
No, since it is strictly necessary for site security it is exempt from the prior-consent requirement, but it should be listed in the cookie policy.
Forms on the site (login, contact, checkout) may return validation errors or an invalid session, because the server can no longer verify the authenticity of the request.