Utilizing machinekey in load-balanced instances without storing decryption key in web.config

Question

I have a load-balanced web app that has two app services, one for east and one for west. An issue has been occurring where AntiForgeryTokens are not being decrypted properly, and in my research this seems to be due to mismatched machinekeys which were automatically generated at runtime on the two app services.

The obvious solution here is to add the machinekey parameter to the web.config in both instances, so the decryption keys are the same.

My issue however, comes from the fact that our repo does not allow any sort of secrets within the repository. Instead, we are required to use Azure Key Vault and dynamically load in the values as the app starts.

My question, is how do I solve this problem without relying on storing secret values in the web.config file? I've tried searching for dynamically setting the decryption key, to no avail. Apologies if this is a common issue.

Check [this answer](https://stackoverflow.com/a/18478929/2791540) — John Wu, Dec 20 '19 at 22:19
Thank you John, this seems to be the correct way of implementing this. — Sean Grant, Dec 23 '19 at 18:24

score 2 · Answer 1 · answered Dec 03 '21 at 04:48

For application running on windows app service, you can use the settings described here:

It will allow you to inject the same machine key values for all your app services.

IF you enable managed identity, you could store the machine values in key vault and use key vault reference in the app service app settings:

@Microsoft.KeyVault(VaultName=myvault;SecretName=mysecret)

Utilizing machinekey in load-balanced instances without storing decryption key in web.config

1 Answers1