2

In the home page of our site we have the login component developed by WFFM. We have a Custom Save action that will call a web api for fetching the result and login into the site.

if we open the site and wait for 10 min in the home page without doing any action and try to login, we are getting an error as "We experienced a technical difficulty while processing your request."

If we try to login immediately(with in 2 min), we are not getting this error. the user is getting logged-in sucessfully.

While looking at the log we could see the following line

WARN Web Forms for Marketers: an exception 'The anti-forgery token could not be decrypted. If this application is hosted by a Web Farm or cluster, ensure that all machines are running the same version of ASP.NET Web Pages and that the configuration specifies explicit encryption and validation keys. AutoGenerate cannot be used in a cluster.' has occured while trying to execute an action ''.

Note: We had hosted the site in two server with LB enabled. One of the two server is used as CM

Have anyone faced this problem.

2

This sounds like your load balancer is routing the request to a different server than the origin home page request and you haven't setup your machine key on each machine to be the same.

TL/DR;

In the web.config add is the following setting for the machineKey and set the values to be the same on each server:

<system.web>
    <machineKey 
        decryptionKey="13C9825F6B5ABB0622CF09B6C7F949F83D113B3CC2351438" 
        validationKey="DA39AFED706512A688EDD4FA5898FABF2D8A0D6897465093B1237C1D46E34F8E7B0E9A09FFE647CAC32DEFE9AFAEDDE6EFE8FF6CDE0BF27C883277BB3566BFA6" 
    />
</system.web>

What is happening?

Internally Asp.Net will use those 2 keys to encrypt/decrypt the anti-forgery token. By default these keys are randomly generated on application start. So when your user gets routed by the load balancer to a different server than the original request, the decryption key will be different and the token cannot be decrypted.

To fix that, you need to make sure that all instances of the same website have the same machine keys.

To generate the values for the machine key, there are a number of online generating sites, like ASP.Net MachineKey Generator.

Once you have the same values on all your instances of that site, it doesn't matter which server the user is routed too, the token will be able to be decrypted.

When you are setting these, it is important to follow these rules too:

  • The keys should be different on each website on the same server. So if you have multi websites are hosting on the same server they keys should be unique.
  • The keys should be different on each environment for the same website. So if your website is hosting in multi-environments ensure that the keys on each environment are differently as well.
  • Hello Richard, Thanks for sharing the Details. We have one Sitecore instance with multiple sites. In this case how can we set the different key for each website, because as the key will be setup in the Web.config. – PVM Sep 11 '18 at 14:13
  • You don't need a different key for each of the sites in a multi-instance site, just for each "website" application in IIS – Richard Seal Sep 11 '18 at 16:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.