Anti-forgery errors are found in the Sitecore Identity server logs every 5 minutes


Description

Anti-forgery errors might occur in the Application Insights approximately every 5 minutes. The issue happens due to the Always On setting on the Azure Web Site. Every 5 minutes Azure pings the Sitecore Identity server URL with an HTTP request. However, the current Azure implementation does not support the ability to change the request to HTTPS or change the default ping route. Even though the request finishes with an error, it successfully completes its purpose to keep the application alive. The following messages can be found in the log records:

System.InvalidOperationException: The antiforgery system has the configuration value AntiforgeryOptions.Cookie.SecurePolicy = Always, but the current request is not an SSL request.
   at Microsoft.AspNetCore.Antiforgery.Internal.DefaultAntiforgery.CheckSSLConfig(HttpContext context)
   at Microsoft.AspNetCore.Antiforgery.Internal.DefaultAntiforgery.GetAndStoreTokens(HttpContext httpContext)
   at Microsoft.AspNetCore.Mvc.ViewFeatures.AntiforgeryExtensions.GetHtml(IAntiforgery antiforgery, HttpContext httpContext)

Solution

To resolve the issue, consider one of the following options: