3

I'm running my web app in IIS. Based on this documentation, "keys are persisted to the HKLM registry in a special registry key that is ACLed only to the worker process account. Keys are encrypted at rest using DPAPI."

It seems like the Antiforgery system needs to decrypt the .AspNetCore.Antiforgery cookie, but I get the error that the key was not found in the key ring.

I have not configured any data protection whatsoever, so it should all be using default settings. Any ideas as to why I'm getting this error and how to fix it?

Inner Exception Message: The key {c13d08a2-b1f6-4c61-ab1d-d19af63e4366} was not found in the key ring. Inner Stack trace:

Exception Message: The antiforgery token could not be decrypted. Stack trace:

at Microsoft.AspNetCore.Antiforgery.Internal.DefaultAntiforgeryTokenSerializer.Deserialize(String serializedToken) at Microsoft.AspNetCore.Antiforgery.Internal.DefaultAntiforgery.GetCookieTokenDoesNotThrow(HttpContext httpContext)

Tseng
  • 61,549
  • 15
  • 193
  • 205
John-Luke Laue
  • 3,736
  • 3
  • 32
  • 60
  • Can you see, either using Fiddler or the debugger, that the cookie is being sent by the browser in the first place? – John K Dec 15 '16 at 02:18
  • the cookies is definitely being sent. when I delete the cookie, asp.net knows to recreate one and it doesn't give me this error message. If the cookie was not being sent, I wouldn't get an error. @JohnK – John-Luke Laue Dec 15 '16 at 03:11
  • Does this error occur for a cookie generated and consumed by the same server/machine? Or different machines? – Nate Barbettini Dec 15 '16 at 03:19
  • What, if any, settings ([such as these](https://msdn.microsoft.com/en-us/library/ff649308.aspx#paght000007_machinekeyexplained)) do you have for cookie encryption in your web.config file? Is there anything about an encryption key, particularly involving the GUID in the exception message you're seeing? Either way, can you decrypt the cookie value as described in [this SO answer](http://stackoverflow.com/a/15407393/5030434)? – John K Dec 15 '16 at 03:31

0 Answers0