What is the __RequestVerificationToken cookie?
__RequestVerificationToken is a cookie set automatically by web applications built on ASP.NET or ASP.NET Core whenever a page includes a form protected by the framework's built-in anti-forgery (anti-CSRF) mechanism.
It typically appears as soon as a visitor loads a page containing a form — login, contact, checkout, or an admin panel — generated by the server itself rather than a third-party script. It is not tied to any marketing or analytics provider; it is part of the site's core technical infrastructure.
What data it stores
The cookie stores a random cryptographic token generated by the server for the current session. On its own, the value contains no personally identifiable information — it exists purely as a verification element.
When a form is submitted, the token in the cookie is compared against a matching token sent via a hidden form field or an HTTP header. If the two do not match, the server rejects the request, since it may originate from a CSRF attack. The data stays on the site's own domain and is not sent to third parties.
What it is used for
The cookie's role is strictly security-related: it prevents forged form submissions sent from other sites from being accepted by your application, a technique known as cross-site request forgery.
For the site owner, this cookie keeps every protected form working correctly and safely — without it, users could see validation errors when submitting forms, or the site could become vulnerable to this type of attack.
Does it require consent?
In CookieFix's classification, __RequestVerificationToken falls under the necessary (strictly necessary) category. Under Article 5(3) of the ePrivacy Directive 2002/58/EC (transposed in Romania via Law 506/2004) and the related guidance followed by ANSPDCP, cookies strictly necessary for a service explicitly requested by the user — here, securely submitting a form — do not require prior consent.
- It should still be listed in the site's cookie policy, with its actual purpose and duration.
- It should not be blocked by the consent banner regardless of the visitor's choice, or forms may stop working.
- Site owners should periodically verify, via a site scan, that this cookie is correctly classified and not mistakenly placed under a category that requires consent.
How to block or delete __RequestVerificationToken
A visitor can delete or block this cookie through browser settings (Chrome, Firefox, Edge, Safari — per-site cookie management). Doing so, however, will likely break anti-CSRF-protected forms, producing an "invalid token" error on submission.
Because it is strictly necessary, a CMP like CookieFix should not auto-block it on page load, unlike statistics or marketing cookies, which it can keep blocked via its auto-blocking script until the visitor gives explicit consent.
Frequently asked questions
No. It is a security cookie used by ASP.NET to prevent cross-site request forgery (CSRF) and does not track visitors' browsing behavior.
No, since it is strictly necessary for securely submitting forms, it is exempt from the prior-consent requirement, but it should still be disclosed in the cookie policy.
The next form submitted on that site may trigger a validation error, requiring the user to reload the page and resubmit the form.
It is typically a session cookie, so it is deleted automatically when the browser closes; the exact duration can vary depending on the ASP.NET application's configuration.