I kept getting a 400 bad request error when trying to post to my razor page. When I compared the request headers between the page where I could not post to another one in my application where posting worked I noticed this difference:

Header from failed post:

Authorization: Negotiate oXcwdaADCgEBoloEWE5UTE1TU1AAAwAAAAAAAABYAAAAAAAAAFgAAAAAAAAAWAAAAAAAAABYAAAAAAAAAFgAAAAAAAAAWAAAABXCiOIKAGFKAAAAD7Fyyg2YfDoN+FYR4J5+KlSjEgQQAQAAAPqrk2LNTZm4AAAAAA==
sec-ch-ua: "Chromium";v="124", "Google Chrome";v="124", "Not-A.Brand";v="99"

Header from successful post:

RequestVerificationToken: CfDJ8GbSvkkuhNhDgf5mY4viJRAeZYsuMasP2upKhs0e1XfUtN0S7xovkXBP2dVmxILxj8zsUK_MGpy4_INi1UzQifImKuFGufxCkM-SjXuWqZ55BzVTKWhqoeDVrGFcs-3BM73h0BLfASFfazLURCH45P1KskBn2ayn5Azg6_vxtsKOP3aqhb6MFqaFo-ycHJDQ6w
sec-ch-ua-mobile: ?0

I then realized that the page that could post successfully had a form on the page, the one that couldn’t did not. The page with no form did not have a hidden field containing the RequestVerificationToken.

I added an empty form to the page and then it was able to post successfully and in the page source I could see that a RequestVerificationToken was now present.

My question is, must a form always be present, even if empty if one is going to post from a page to the server? The reason I had no form here is because there was nothing for the user to fill out, just a grid with delete buttons where clicking delete posted to the server with the grid row id to delete the corresponding entity from the database.

If the only way for this to work is to put an empty form on the page that’s fine, just wanted to make sure there wasn’t a more elegant solution I’m not aware of.