If both the CSRF validation and the Session state is turned off, the pages containing AsyncUpload control will throw a null reference exception.
<appSettings>
<add key="Telerik.AsyncUpload.EnableCsrfValidation" value="false" />
</appSettings>
<system.web>
<sessionState mode="Off" />
We just updated to Q3 2026 to see if this had been addressed. While null reference exception is not thrown, the upload itself seems to be failing when session state is disabled. When session state is enabled, it works fine though. Please check below screenshot that shows uploading failure and the network response.
Here is the markup, is there anything else that we need to configure?
Hi Owen,
Thank you for taking the time to report the regression and for providing such clear details. Your feedback helped us pinpoint the issue quickly.
I’m glad to confirm that the problems you identified have now been fixed. These improvements will be included in our upcoming 2026 Q3 release.
We appreciate your diligence and support.
Regards,
Attila Antal
Progress Telerik