zoukankan      html  css  js  c++  java
  • Padding is invalid and cannot be removed

    Padding is invalid and cannot be removed

    Exception:
    Stack Trace:   at System.Security.Cryptography.RijndaelManagedTransform.DecryptData(Byte[] inputBuffer, Int32 inputOffset,           Int32 inputCount, Byte[]& outputBuffer, Int32 outputOffset, PaddingMode paddingMode, Boolean fLast)   at System.Security.Cryptography.RijndaelManagedTransform.TransformFinalBlock(Byte[] inputBuffer,           Int32 inputOffset, Int32 inputCount)   at System.Security.Cryptography.CryptoStream.FlushFinalBlock()   at System.Web.Configuration.MachineKeySection.EncryptOrDecryptData(Boolean fEncrypt, Byte[] buf, Byte[] modifier,           Int32 start, Int32 length, Boolean useValidationSymAlgo)   at System.Web.UI.Page.DecryptString(String s)

    Reason:
    Usually these errors appear in the web farm deployment when the spiders come through the site and they try to request pages with invalid ViewState, etc. Most likely they are trying to reference an old version of the .axd file because they are built dynamically and timestamped for authenticity.

    If you deploy your application in a Web farm, you must ensure that the configuration files on each server share the same value for validationKey and decryptionKey, which are used for hashing and decryption respectively. This is required because you cannot guarantee which server will handle successive requests.

    With manually generated key values, the <machineKey> settings should be similar to the following example. Please make sure <machineKey> element is underneath <system.web> section in the web.config file.

    <machineKey validationKey="0BE61B38B9836B541C45728ADB9D93A6FD819169DBB6AD20078A70F474650CC0295C69131E083A6B3762C457BBAF3E66E18F294FDA434B9DD6758631A90A2E20" decryptionKey="B80CC12266B36CCF35EF0708DB5854EDA3BBEBA1A7C89A4E" validation="SHA1"/>

    You can refer to the following article to get more information about how to build the validationKey and descriptionKey.
    http://support.microsoft.com/kb/312906 - Generate Machine Key using C#
    http://www.eggheadcafe.com/articles/20030514.asp - Generate Machine Key Elements for Web Farm


    If you want to isolate your application from other applications on the same server, place the <machineKey> in the Web.config file for each application on each server in the farm. Ensure that you use separate key values for each application, but duplicate each application's keys across all servers in the farm.


    In the meanwhile, there is an easier approach-- you can disable the keying of viewstate to a particular server using a simple page directive at the top of your .aspx pages:

    <%@ Page Language="vb" AutoEventWireup="false" Codebehind="MyPage.aspx.vb"
     Inherits="MyAssembly.MyPage" enableViewStateMac="False" %>

    Alternately, you can modify the pages element in Web.config:

    <system.web>
      <pages enableViewStateMac="false" />
    </system.web>

    Either way, works great. But the latter solution is not recommended in the production ecommerce site because of security issue.

    References:
    1. Web Farms and ASP.NET ViewState, http://www.codinghorror.com/blog/archives/000132.html
    2. ASP.Net’s WebResource.axd and machineKey badness, http://blog.aproductofsociety.org/?p=11
    3. How To Configure The Machine Key In ASPNET2, http://channel9.msdn.com/wiki/default.aspx/Channel9.HowToConfigureTheMachineKeyInASPNET2

  • 相关阅读:
    Java基础知识之设计模式--观察者模式
    Java基础知识之设计模式--工厂模式
    Java Socket应用
    Java基础知识之设计模式--单例模式
    Docker的三种网络代理配置
    Docker被禁了!只能靠它了......
    老司机带你出坑:请收下这份运维故障处理指南
    这样理解 HTTP,面试再也不用慌了~
    为什么说卷积神经网络,是深度学习算法应用最成功的领域之一?
    一文搞懂CDN加速原理
  • 原文地址:https://www.cnblogs.com/rickie/p/900021.html
Copyright © 2011-2022 走看看