.Net core AntiForgeryToken is not matching with server

Question

I am working on Asp.Net core application and Application is running fine on my local but I am not able to validate Antiforgery token on the server. Error: "Microsoft.AspNetCore.Antiforgery.AntiforgeryValidationException: The antiforgery token could not be decrypted."

Below is the code.

@section scripts {
<script type="text/javascript">
    $(document).ready(function() {
        $("#btnstart").click(function(e) {
            let productvals = $("#productlist").val();
            let runnumber = $("#runnum").val();
            let btnval = $("#btnstart").val();
            e.preventDefault();
            $.ajax({
                url: "@Url.Action("
                CheckRunnumber ","
                Validation ")",
                type: "POST",
                dataType: "json",
                data: {
                    runnumber: $('#runnum').val()
                },
                success: function(data) {
                    if (data.success == "True") {
                        console.log(data);
                        console.log(data.btnstartval);
                        //$("#Runform").submit();
                        if ($("#Runform").valid()) {
                            console.log(productvals, runnumber, data.btnstartval);
                            console.log(gettoken());
                            $.ajax({
                                url: "@Url.Action("
                                RunCase ", "
                                CallService ")",
                                type: "POST",
                                dataType: "json",
                                data: {
                                    products: productvals,
                                    runnumber: runnumber,
                                    button: data.btnstartval,
                                    __RequestVerificationToken: gettoken()
                                },
                                contentType: 'application/x-www-form-urlencoded; charset=utf-8'
                            });
                        } else {
                            alert("Error");
                            e.preventDefault();
                        }
                    }
                }
            });

            function gettoken() {
                var token = '@Html.AntiForgeryToken()';
                token = $(token).val();
                return token;
            }
        }
    }
</script>
}

To compare this token I logged it on the console window and it is different then the one under Application tab inside the inspect window.

Below is the error log I am getting.

2020-10-08T13:00:05.5115395-05:00 0HM3BMFTTVJ22:00000001 [ERR] An exception was thrown while deserializing the token. (348bf365)
Microsoft.AspNetCore.Antiforgery.AntiforgeryValidationException: The antiforgery token could not be decrypted.
 ---> System.Security.Cryptography.CryptographicException: The key {dbeef040-4a73-45ff-8b62-064683015ea1} was not found in the key ring.
   at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector.UnprotectCore(Byte[] protectedData, Boolean allowOperationsOnRevokedKeys, UnprotectStatus& status)
   at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector.DangerousUnprotect(Byte[] protectedData, Boolean ignoreRevocationErrors, Boolean& requiresMigration, Boolean& wasRevoked)
   at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector.Unprotect(Byte[] protectedData)
   at Microsoft.AspNetCore.Antiforgery.DefaultAntiforgeryTokenSerializer.Deserialize(String serializedToken)
   --- End of inner exception stack trace ---
   at Microsoft.AspNetCore.Antiforgery.DefaultAntiforgeryTokenSerializer.Deserialize(String serializedToken)
   at Microsoft.AspNetCore.Antiforgery.DefaultAntiforgery.GetCookieTokenDoesNotThrow(HttpContext httpContext)
2020-10-08T13:00:35.9439222-05:00 0HM3BMFTTVJ22:00000004 [INF] Process not found (d326d86c)

score 1 · Answer 1 · answered Oct 09 '20 at 05:24

Do you host your application on shared server backend or else? It seems that your application doesn't have enough permission to read the key.

I suggest you could try to modify the IIS application pool identity to have enough permission to read the key. More details ,you could refer to below steps:

1.Open IIS management console:

2.Select your application pool

3.Modify the application pool identity to local system or other domain account which has enough permission to access your keys.

If this couldn't solve your issue, could you please share the startup.cs settings?

.Net core AntiForgeryToken is not matching with server

1 Answers1