Trying to create empty Contact List in Sitecore 9 Update 2 through List Manager but getting 403 HTTP response code and below exception.

Request URL is https://sc9u2.sc/sitecore/api/ssc/ListManagement/ContactList

__RequestVerificationToken is part of Request headers. I have already tried it in latest Chrome and Firefox but no difference. In IE11 it is working...


Message : An error has occurred.

ExceptionMessage :  The required anti-forgery cookie "__RequestVerificationToken" is not present.

ExceptionType : System.Web.Mvc.HttpAntiForgeryException

StackTrace : at System.Web.Helpers.AntiXsrf.TokenValidator.ValidateTokens(HttpContextBase httpContext, IIdentity identity, AntiForgeryToken sessionToken, AntiForgeryToken fieldToken) at System.Web.Helpers.AntiXsrf.AntiForgeryWorker.Validate(HttpContextBase httpContext, String cookieToken, String formToken) at Sitecore.Web.Http.Filters.ValidateHttpAntiForgeryTokenAttribute.OnAuthorization(HttpActionContext actionContext)

Any thoughts?


For me looks like this is a Sitecore bug. As far I see Chrome, Firefox and IE works differently on validating tokens.

On Sitecore is a setting IsAuthorizationBypassAllowed. This setting, when set to true will ignore Request Validation checking on Controllers where the ValidateHttpAntiForgeryToken attribute is set.

Please create a patch file for :

<setting name="Sitecore.Web.IsAuthorizationBypassAllowed" value="true" /> 

@Pete Navara created a blogpost about this issue and he described it like an EXM wizard :


  • Thanks Vlad. Worked like charm. Even Forms finally appeared in list and Experience Analytics is also showing graphs without weird exceptions. – Peter Procházka Oct 19 '18 at 12:42
  • Is this still bug on Sitecore or is it fixed? I'm facing same issue and tried the patch seems to fix the issue but I'm concerned about security ramification. – weblabor Apr 17 at 3:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.