OrchardCMS / Orchard

Orchard is a free, open source, community-focused Content Management System built on the ASP.NET MVC platform.
https://orchardproject.net
BSD 3-Clause "New" or "Revised" License
2.38k stars 1.12k forks source link

Viewstate MAC error (clearing cookies fixes temporarily) #74

Closed orchardbot closed 9 years ago

orchardbot commented 14 years ago

@bradmi created: https://orchard.codeplex.com/workitem/16242

REPRO: Not sure how to get into this state, but I ran into this running Orchard under IIS (http://localhost). The site worked for awhile, but days later when I tried the site and clicked the "Login" link on the home page, I got this cryptic error:

"Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster."

Clearing cookies in IE resolved the problem (temporarily). According to Nathan, setting a static machine key in Web.config also works:

"Clear your cookie(s) and it should go away...until it comes back :). This is related to the antiforgerytoken and setting your machinekey does keep it stable. I forget what the exact repro steps are but try using the app (hitting at least one form with a request verification input) so you get cookied and try to restart the app or drop out a fresh build...something to get the encryption out of sync between the server and cookie."

Needs investigation into the correct long term fix.

orchardbot commented 14 years ago

@bleroy commented:

This will only happen in development cases and there is a workaround. It will never happen in production unless the key is inconsistent across a web farm or changed.

orchardbot commented 14 years ago

@bleroy commented:

Please investigate.

orchardbot commented 14 years ago

manudea commented:

Same error here. Just installed on localhost, port 8888, from Web Platform Installer. this is the error:

Server Error in '/' Application.

Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.

Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.Web.HttpException: Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.

Source Error:

An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.

Stack Trace:

[CryptographicException: Padding is invalid and cannot be removed.] System.Security.Cryptography.RijndaelManagedTransform.DecryptData(Byte[] inputBuffer, Int32 inputOffset, Int32 inputCount, Byte[]& outputBuffer, Int32 outputOffset, PaddingMode paddingMode, Boolean fLast) +7599070 System.Security.Cryptography.RijndaelManagedTransform.TransformFinalBlock(Byte[] inputBuffer, Int32 inputOffset, Int32 inputCount) +208 System.Security.Cryptography.CryptoStream.FlushFinalBlock() +33 System.Web.Configuration.MachineKeySection.EncryptOrDecryptData(Boolean fEncrypt, Byte[] buf, Byte[] modifier, Int32 start, Int32 length, IVType ivType, Boolean useValidationSymAlgo) +225 System.Web.UI.ObjectStateFormatter.Deserialize(String inputString) +195

[ViewStateException: Invalid viewstate. Client IP: ::1 Port: 10692 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.70 Safari/533.4 ViewState: IelP7tc2wx0vDdMAF8rm/iXU8jrA2HVjIZJac63UZ3MYh3GSMXNPf0Bi5OMS49yr Referer: Path: /]

[HttpException (0x80004005): Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.] System.Web.UI.ViewStateException.ThrowError(Exception inner, String persistedState, String errorPageMessage, Boolean macValidationError) +106 System.Web.UI.ViewStateException.ThrowMacValidationError(Exception inner, String persistedState) +14 System.Web.UI.ObjectStateFormatter.Deserialize(String inputString) +242 System.Web.UI.ObjectStateFormatter.System.Web.UI.IStateFormatter.Deserialize(String serializedState) +4 System.Web.Mvc.AntiForgeryDataSerializer.Deserialize(String serializedToken) +91

orchardbot commented 14 years ago

liquidboy commented:

Hi , I am actually getting this quite alot in AZURE.

I'm continuously re-deploying my app to azure and sometimes im tearing down / rebuilding new instances.

==== error =======

Server Error in '/' Application.

Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster. Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.Web.HttpException: Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.

Source Error:

An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.

Stack Trace:

[CryptographicException: Padding is invalid and cannot be removed.] System.Security.Cryptography.RijndaelManagedTransform.DecryptData(Byte[] inputBuffer, Int32 inputOffset, Int32 inputCount, Byte[]& outputBuffer, Int32 outputOffset, PaddingMode paddingMode, Boolean fLast) +2910 System.Security.Cryptography.RijndaelManagedTransform.TransformFinalBlock(Byte[] inputBuffer, Int32 inputOffset, Int32 inputCount) +286 System.Security.Cryptography.CryptoStream.FlushFinalBlock() +51 System.Web.Configuration.MachineKeySection.EncryptOrDecryptData(Boolean fEncrypt, Byte[] buf, Byte[] modifier, Int32 start, Int32 length, IVType ivType, Boolean useValidationSymAlgo) +404 System.Web.UI.ObjectStateFormatter.Deserialize(String inputString) +213

[ViewStateException: Invalid viewstate. Client IP: 121.210.88.210 Port: 61048 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; Zune 4.0; OfficeLiveConnector.1.4; OfficeLivePatch.1.3; InfoPath.3; .NET4.0C; .NET4.0E) ViewState: 84CIgFntvWYlz5DrFrgtDbGfoxbxhE3v+gLklKfUdovr58FWtOQtbHAj7o1o6hD/ Referer: Path: /]

[HttpException (0x80004005): Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.] System.Web.UI.ViewStateException.ThrowError(Exception inner, String persistedState, String errorPageMessage, Boolean macValidationError) +157 System.Web.UI.ObjectStateFormatter.Deserialize(String inputString) +562 System.Web.Mvc.AntiForgeryDataSerializer.Deserialize(String serializedToken) +135

orchardbot commented 14 years ago

@heskew commented:

@liquidboy Do you have a in your web.config?

http://aspnetresources.com/tools/machineKey

orchardbot commented 14 years ago

madridjohn commented:

I confirm this to be the case as well.... I only use firefox and noticed the error was happening in firefox and NOT IE... so i cleared my cookies using firebug and a plugin..... and added a machinekey to my web.config ... and currently its working..

orchardbot commented 13 years ago

@bleroy closed and commented:

Fixed in MVC 3