WebResource.axd request causing errors

[PJ]

I'm getting an error in the event viewer as well as a script error in the
browser when a page references WebResource.axd. The application is running
on W2k3 server and does not occurr on my local xp development machine.

Has anyone encountered this?

Event Type: Warning
Event Source: ASP.NET 2.0.50727.0
Event Category: Web Event
Event ID: 1309
Date: 1/5/2006
Time: 11:00:17 PM
User: N/A
Computer: 216-55-185-220
Description:
Event code: 3005
Event message: An unhandled exception has occurred.
Event time: 1/5/2006 11:00:17 PM
Event time (UTC): 1/6/2006 7:00:17 AM
Event ID: 9154807ea7364b0ba0db45c2a4f2eb90
Event sequence: 43
Event occurrence: 6
Event detail code: 0

Exception information:
Exception type: CryptographicException
Exception message: Padding is invalid and cannot be removed.

Thread information:
Thread ID: 1
Thread account name: 216-55-185-220\MyStreakASP
Is impersonating: False
Stack trace: at
System.Security.Cryptography.RijndaelManagedTransform.DecryptData(Byte[]
inputBuffer, Int32 inputOffset, Int32 inputCount, Byte[]& outputBuffer,
Int32 outputOffset, PaddingMode paddingMode, Boolean fLast)
at
System.Security.Cryptography.RijndaelManagedTransform.TransformFinalBlock(Byte[]
inputBuffer, Int32 inputOffset, Int32 inputCount)
at System.Security.Cryptography.CryptoStream.FlushFinalBlock()
at
System.Web.Configuration.MachineKeySection.EncryptOrDecryptData(Boolean
fEncrypt, Byte[] buf, Byte[] modifier, Int32 start, Int32 length, Boolean
useValidationSymAlgo)
at System.Web.UI.Page.DecryptString(String s)
at
System.Web.Handlers.AssemblyResourceLoader.System.Web.IHttpHandler.ProcessRequest(HttpContext
context)
at
System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean&
completedSynchronously)

 

[eric.olstad]

I'm dealing with the same problem right now. I'm pulling my hair out.
Any luck finding a solution?

 

[Sam Norris]

Me too ... any update?

Thanks

 

[eric.olstad]

Nothing here... still haven't corrected the issue.

 

[Sam Norris]

My issue was that I had an http module that performed an SSL redirect
based on page name and webresource.axd was not being requested from the
same url or something ... anyhow, I am going to have to cross this
bridge again since SSL vs non-SSL redirects is common between pages on
the site.

 

[eric.olstad]

Microsoft considers this problem resolved, yet I've seen multiple
instances of it occuring with other people on non-webfarm sites:

http://lab.msdn.microsoft.com/Produ...edbackid=17c64976-ee21-4055-9de4-992d9c59e589

Tis quite annoying. Currently I've modified my web.config so that I
can actually develop and test my site without this problem killing my
sessions. But my site probably has some security hole that I'm not
going to tackle just yet.

 

[eric.olstad]

I've finally found a solution, and it is beautiful, but also completely
frustrating at the same time. Long story short, it's the machineKey
element in the web.config.

Go here, to generate a validation key.
http://www.eggheadcafe.com/articles/GenerateMachineKey/GenerateMachineKey.aspx

By setting this value, you define a validation key that will match the
cookie and no more CryptographicException. It worked beautifully for
me. The frustrating part is that no one could tell us this simple
solution.

 

[cmorley]

Server affinity issue

Hello,

I ran into this today, and have partial knowledge of the solution.

I have two servers running as mirrors of each other, and a load balancer that randomly selects one of the two servers as requests come in.

Scott Hanselman who is an author of Professional ASP.NET 2.0 from Wrox, writes on http://www.hanselman.com/blog/LoadBalancingAndASPNET.aspx that you need to be careful about server affinity in .NET 2.0 because of the client side encrypted payloads, which are decrypted on the server side using the machine key.

I plan on syncing my machine keys, and expect this problem to disappear. I have to wonder how very large sessions (where you wouldn't want it in the .NET hidden session keys, ahem, encrypted payloads) are handled though. I have seen cool demos from Tangosol, who provides ways to share client session data on the server side, even where a web farm is involved with load balancing. I'm not sure how one would approach this issue in .NET, without perhaps using Java and Tangosol as a backend crutch.

If anyone has access to more detail about how exactly to synchronize machine keys that would be great. Scott Hanselman makes a very quick note to make sure to do it, and provides this link: http://msdn.microsoft.com/library/d...n-us/cpgenref/html/gngrfmachinekeysection.asp

Christopher Morley
Webmaster
Direct Capital Corporation

 

[cmorley]

Syncing machine keys

I did not see the responses to the original posting until after I logged in for the first time, and had written my reply. The follow to this is that using the same machine key in each web.config as generated by the online web service mentioned in a separate post, well, that worked.

Thank you,
Christopher Morley
Webmaster
Direct Capital Corporation