2

In the home page of our site we have the login component developed by WFFM. We have a Custom Save action that will call a web api for fetching the result and login into the site.

if we open the site and wait for 10 min in the home page without doing any action and try to login, we are getting an error as "We experienced a technical difficulty while processing your request."

If we try to login immediately(with in 2 min), we are not getting this error. the user is getting logged-in sucessfully.

While looking at the log we could see the following line

WARN Web Forms for Marketers: an exception 'The anti-forgery token could not be decrypted. If this application is hosted by a Web Farm or cluster, ensure that all machines are running the same version of ASP.NET Web Pages and that the configuration specifies explicit encryption and validation keys. AutoGenerate cannot be used in a cluster.' has occured while trying to execute an action ''.

Note: We had hosted the site in two server with LB enabled. One of the two server is used as CM

Have anyone faced this problem.

Improve this question

1 Answer 1

Reset to default
2

This sounds like your load balancer is routing the request to a different server than the origin home page request and you haven't setup your machine key on each machine to be the same.

TL/DR;

In the web.config add is the following setting for the machineKey and set the values to be the same on each server:

<system.web>
    <machineKey 
        decryptionKey="13C9825F6B5ABB0622CF09B6C7F949F83D113B3CC2351438" 
        validationKey="DA39AFED706512A688EDD4FA5898FABF2D8A0D6897465093B1237C1D46E34F8E7B0E9A09FFE647CAC32DEFE9AFAEDDE6EFE8FF6CDE0BF27C883277BB3566BFA6" 
    />
</system.web>

What is happening?

Internally Asp.Net will use those 2 keys to encrypt/decrypt the anti-forgery token. By default these keys are randomly generated on application start. So when your user gets routed by the load balancer to a different server than the original request, the decryption key will be different and the token cannot be decrypted.

To fix that, you need to make sure that all instances of the same website have the same machine keys.

To generate the values for the machine key, there are a number of online generating sites, like ASP.Net MachineKey Generator.

Once you have the same values on all your instances of that site, it doesn't matter which server the user is routed too, the token will be able to be decrypted.

When you are setting these, it is important to follow these rules too:

  • The keys should be different on each website on the same server. So if you have multi websites are hosting on the same server they keys should be unique.
  • The keys should be different on each environment for the same website. So if your website is hosting in multi-environments ensure that the keys on each environment are differently as well.
Improve this answer
6
  • Hello Richard, Thanks for sharing the Details. We have one Sitecore instance with multiple sites. In this case how can we set the different key for each website, because as the key will be setup in the Web.config.
    – PVM
    Sep 11, 2018 at 14:13
  • You don't need a different key for each of the sites in a multi-instance site, just for each "website" application in IIS
    – Richard Seal ♦
    Sep 11, 2018 at 16:28
  • Hi Richard - I tried using above approach and added machine key in the web.config under system.web. However, I still face the same issue. Is there any alternative solution?
    – Kuldeep Sharma
    Oct 9, 2019 at 9:40
  • Can you please remove the duplicate tag from my question? because the above solution didn't work for me and i am using single sitecore instance locally. I assume that i am facing similar issue due to different reason i.e. Multiple Anti-Forgery settings on the page. Please provide the solution in case you have any.
    – Kuldeep Sharma
    Oct 9, 2019 at 11:27
  • this is a mix of .ASPX and MVC. As per the client need, we can't change the old layout (.aspx) and sub-layout (.ascx) and we have to new Sitecore Forms instead of old WFFM. As you know Sitecore forms uses the MVC rendering. I hope this makes my point clear.
    – Kuldeep Sharma
    Oct 9, 2019 at 11:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.