Padding is invalid and cannot be removed
Padding is invalid and cannot be removed
Exception:
Stack Trace: at System.Security.Cryptography.RijndaelManagedTransform.DecryptData(Byte[] inputBuffer, Int32 inputOffset, Int32 inputCount, Byte[]& outputBuffer, Int32 outputOffset, PaddingMode paddingMode, Boolean fLast) at System.Security.Cryptography.RijndaelManagedTransform.TransformFinalBlock(Byte[] inputBuffer, Int32 inputOffset, Int32 inputCount) at System.Security.Cryptography.CryptoStream.FlushFinalBlock() at System.Web.Configuration.MachineKeySection.EncryptOrDecryptData(Boolean fEncrypt, Byte[] buf, Byte[] modifier, Int32 start, Int32 length, Boolean useValidationSymAlgo) at System.Web.UI.Page.DecryptString(String s)
Reason:
Usually these errors appear in the web farm deployment when the spiders come through the site and they try to request pages with invalid ViewState, etc. Most likely they are trying to reference an old version of the .axd file because they are built dynamically and timestamped for authenticity.
If you deploy your application in a Web farm, you must ensure that the configuration files on each server share the same value for validationKey and decryptionKey, which are used for hashing and decryption respectively. This is required because you cannot guarantee which server will handle successive requests.
With manually generated key values, the <machineKey> settings should be similar to the following example. Please make sure <machineKey> element is underneath <system.web> section in the web.config file.
<machineKey validationKey="0BE61B38B9836B541C45728ADB9D93A6FD819169DBB6AD20078A70F474650CC0295C69131E083A6B3762C457BBAF3E66E18F294FDA434B9DD6758631A90A2E20" decryptionKey="B80CC12266B36CCF35EF0708DB5854EDA3BBEBA1A7C89A4E" validation="SHA1"/>
You can refer to the following article to get more information about how to build the validationKey and descriptionKey.
http://support.microsoft.com/kb/312906 - Generate Machine Key using C#
http://www.eggheadcafe.com/articles/20030514.asp - Generate Machine Key Elements for Web Farm
If you want to isolate your application from other applications on the same server, place the <machineKey> in the Web.config file for each application on each server in the farm. Ensure that you use separate key values for each application, but duplicate each application's keys across all servers in the farm.
In the meanwhile, there is an easier approach-- you can disable the keying of viewstate to a particular server using a simple page directive at the top of your .aspx pages:
<%@ Page Language="vb" AutoEventWireup="false" Codebehind="MyPage.aspx.vb"
Inherits="MyAssembly.MyPage" enableViewStateMac="False" %>
Alternately, you can modify the pages element in Web.config:
<system.web>
<pages enableViewStateMac="false" />
</system.web>
Either way, works great. But the latter solution is not recommended in the production ecommerce site because of security issue.
References:
1. Web Farms and ASP.NET ViewState, http://www.codinghorror.com/blog/archives/000132.html
2. ASP.Net’s WebResource.axd and machineKey badness, http://blog.aproductofsociety.org/?p=11
3. How To Configure The Machine Key In ASPNET2, http://channel9.msdn.com/wiki/default.aspx/Channel9.HowToConfigureTheMachineKeyInASPNET2
【推荐】编程新体验,更懂你的AI,立即体验豆包MarsCode编程助手
【推荐】凌霞软件回馈社区,博客园 & 1Panel & Halo 联合会员上线
【推荐】抖音旗下AI助手豆包,你的智能百科全书,全免费不限次数
【推荐】博客园社区专享云产品让利特惠,阿里云新客6.5折上折
【推荐】轻量又高性能的 SSH 工具 IShell:AI 加持,快人一步