We need to explicty call UseAntiforgery, otherwise it is called automatically before our middleware that will lead to UmbracoRouteValueTransformer being called instead of static file middleware.

src/Umbraco.Web.Common/ApplicationBuilder/UmbracoApplicationBuilder.cs

@@ -89,6 +89,8 @@ public class UmbracoApplicationBuilder : IUmbracoApplicationBuilder, IUmbracoEnd
         AppBuilder.UseAuthentication();
         AppBuilder.UseAuthorization();
 
+        AppBuilder.UseAntiforgery();
+
         // This must come after auth because the culture is based on the auth'd user
         AppBuilder.UseRequestLocalization();