MachineKey in web.config

There are few scenarios that you want to add MachineKey into your web application’s web.config:

1. You have a web farm and in each server the machine.config set to auto generate machinekey.
2. You want to use “Encyrpted” password format in ASP.NET membership provider.
3. You get intermittent error of  “Validation of viewstate MAC failed…..”

To fix problem #3,  you can also set one of all these in the <page settings:

<page enableEventValidation=”false” viewStateEncryptionMode=”Never” enableViewStateMac=”false”

However you have to be aware of the risk of this change, as it opens door for ViewState value tampering. (Joteke has an intersting finding on large pages having gridview control. Basically in this case, you have to set above values for avoid the error, which is casued by the position of a hidden field containing some encrypted  information.)

Here are 2 online tools to generate the random machine key for you:  this and this. A sample MachineKey node:

<machineKey
validationKey=”56AB7132992003EE87F74AE4D9675D65EED8018D3528C0B8874905B51940DEAF6B85F1D922D19AB8F69781B2326A2F978A064708822FD8C54ED74CADF8592E17″
decryptionKey=”A69D80B92A16DFE1698DFE86D4CED630FA56D7C1661C8D05744449889B88E8DC”
validation=”SHA1″ decryption=”AES”
/>

The <machineKey> should be put inside <system.web> section.

Please refer to MSDN for documentation:  syntax and overview.

About these ads