We noticed on our upgraded 10.2 site that some session based functionality stopped working reliably when having more that one replica. Redis is used for storing session data and is getting populated correctly.

The issues seemed to be with the machine key, which must be different per replica. To solve this we were able to add the machinekey element in the web.config.



The sites reliably work with this fix in, but the issue is that the keys are the same for all of our environments which is a security issue (serious?).

Ideally we'd want to have these stored in keyvault, but I can't find a way to get these values in like we would with AppSettings or ConnectionStrings. I've tried added environment variables, but haven't had any luck so far.

I feel like others must surely have come up against this issue, but I can't find any content online and Sitecore Support have no documentation / advice to give.

How can I set the machine key for all replicas with a configurable method that can be different per environment?

1 Answer 1


The only way I could get this to work was by changing the configuration in code when the application starts.

Firstly, create a class that can modify the machine keys section using app settings.

public class MachineKeys {
    public MachineKeys(string encryptionKey, string validationKey) {
        this.DecryptionKey = encryptionKey;
        this.ValidationKey = validationKey;

    public string Decryption { get; set; }

    public string DecryptionKey { get; }

    public string Validation { get; set; }

    public string ValidationKey { get; }

    public static void InstallKeysFromAppSettings()

    public static void Install(MachineKeys keys)

        if (keys == null)

        var getter = typeof (MachineKeySection).GetMethod("GetApplicationConfig", BindingFlags.Static | BindingFlags.NonPublic);

        var config = (MachineKeySection) getter.Invoke(null, Array.Empty < object > ());

        var readOnlyField = typeof (ConfigurationElement).GetField("_bReadOnly", BindingFlags.Instance | BindingFlags.NonPublic);

        readOnlyField.SetValue(config, false);

        config.DecryptionKey = keys.DecryptionKey;

        config.ValidationKey = keys.ValidationKey;

        if (!string.IsNullOrEmpty(keys.Decryption))
            config.Decryption = keys.Decryption;

        if (!string.IsNullOrEmpty(keys.Validation) && Enum.TryParse(keys.Validation, out MachineKeyValidation parsedMachineKeyValidation))
            config.Validation = parsedMachineKeyValidation;

        readOnlyField.SetValue(config, true);


    public static MachineKeys GetKeysFromAppSettings()
        var encKey = ConfigurationManager.AppSettings["MachineDecryptionKey"];

        if (string.IsNullOrEmpty(encKey))
            return null;

        var valKey = ConfigurationManager.AppSettings["MachineValidationKey"];

        if (string.IsNullOrEmpty(valKey))
            return null;

        var decryption = ConfigurationManager.AppSettings["MachineDecryption"];

        var validation = ConfigurationManager.AppSettings["MachineValidation"];

        return new MachineKeys(encKey, valKey)
            Decryption = decryption,
            Validation = validation

Then create a pipeline processor class that uses this

public class Processor
    public void Process(PipelineArgs args)

And patch this into the initialize pipeline.

You can then set the following app settings, with secret substitution if you need it.

  • MachineDecryption
  • MachineDecryptionKey
  • MachineValidation
  • MachineDecryptionKey
  • machine key and above 4 keys we need to put static value in web.config file? Commented Sep 6, 2023 at 9:45
  • how to generate these key? and Where we need to configure these value like web.config file or any environment variable? Commented Sep 6, 2023 at 9:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.