IsolateApps causes Decryption key specified has invalid hex characters

asp.net-mvc encryption machinekey
WernerVA picture WernerVA · Feb 21, 2013 · Viewed 28k times · Source

I working on a MVC 4 site which has uses Authentication. The site requires that I specify the Machine Key values. I did this via the IIS interface having deselected the "automatically generate at runtime", generated the key values and having selected "generate a unique key for each application"

The web.config entry looks something like this:

<machineKey decryption="DES" decryptionKey="{hex-key value},IsolateApps" 
    validationKey="{hex-key value},IsolateApps" />;

While this seems to work fine on another web project it causes the "Decryption key specified has invalid hex characters" error on the dev machine I am working on now (both in IIS-Express and IIS 7.5).

Removing ",IsolateApps" from the key values solves the issue but since I need this option on in production I dont want to be removing it now only to have this issue when deploying.

What gives? The dev box is a SQL 2008 R2 box with .net 2.0 and .net 4.0.

Answer

Joe Daley picture Joe Daley · Mar 14, 2013

The IsolateApps modifier causes ASP.NET to generate a unique key for each application on your server. This is only applicable if you are getting ASP.NET to auto-generate keys at runtime.

If you are not getting ASP.NET to auto-generate keys, and are instead specifying the keys using decryptionKey="{hex-key value}", then the way to get ASP.NET to use a different key for each application is to simply specify a different key in each application's Web.config.

The IIS config GUI allows you to create a Web.config with an explicit key together with the IsolateApps modifier, which is invalid, and in my opinion is a bug in the config GUI.

Related questions

What algorithm Asp.net Identity uses to encrypt the password?

What kind of algorithm does Asp.Net Identity framework use to encrypt the password? I have a scenario where android, iPhone, web and desktop use the same database. This password should be encrypted, so in ASP.NET MVC I have …

Read More
JQuery - $ is not defined

I have a simple jquery click event <script type="text/javascript"> $(function() { $('#post').click(function() { alert("test"); }); }); </script> and a jquery reference defined in the site.master <script src="<%=ResolveUrl("~/Scripts/jquery-1.3.2.js")%&…

Read More
A potentially dangerous Request.Form value was detected from the client

Every time a user posts something containing < or > in a page in my web application, I get this exception thrown. I don't want to go into the discussion about the smartness of throwing an exception or crashing an …

Read More