IIS 7 Tip # 10 You can generate machine keys from the IIS manager

IIS 7 Tip # 10 You can generate machine keys from the IIS manager

  • Comments 11

The machineKey element of the ASP.NET web.config specifies the algorithm and keys that ASP.NET will use for encryption. By default the validationKey and the decryptionKey keys are set to AutoGenerate which means the runtime will generate a random key for use. This works fine for applications that are deployed on a single server. When you use webfarms a client request can land on any one of the servers in the webfarm. Hence you will have to hardcode the validationKey and the decryptionKey on all your servers in the farm with a manually generated key.

There are a lot of articles that describe how to use RNGCryptoServiceProvider to generate a random key. There are also a lot of online tools that generate random keys for you. But I would suggest writing your own script because any one who has access to these keys can do evil things like tamper your forms authentication cookie or viewstate.

With IIS 7 you no longer have to do this manually. The IIS 7.0 manager has a built in feature that you can use to generate these keys.

machinekeys

It uses RNGCryptoServiceProvider internally to create a random key. The value is stored locally in the web.config of that application something like

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.web>
        <machineKey decryptionKey="F6722806843145965513817CEBDECBB1F94808E4A6C0B2F2,IsolateApps" validationKey="C551753B0325187D1759B4FB055B44F7C5077B016C02AF674E8DE69351B69FEFD045A267308AA2DAB81B69919402D7886A6E986473EEEC9556A9003357F5ED45,IsolateApps" />
    </system.web>
</configuration>

You can copy it and paste it in the web.config file of all the servers in the webfarm.

Bookmark and Share

Leave a Comment
  • Please add 2 and 4 and type the answer here:
  • Post
  • Thank you for submitting this cool story - Trackback from DotNetShoutout

  • IIS 7 Tip # 10 You can generate machine keys from the IIS manager たけはらさんのBlog経由の情報。 IIS7の管理ツールからマシンキーの生成ができるんですね。...

  • Web The Evolution of a Website Design Twitter from ASP.NET IIS 7 Tip # 10 You can generate machine keys

  • WebTheEvolutionofaWebsiteDesignTwitterfromASP.NETIIS7Tip#10Youcangenera...

  • Great post but you can generate Online Machine key as well.

    It offers various algorithms to select for encryption and decryption..

    www.a2zmenu.com/.../Machine-Key-Generator.aspx

  • hehehehe, ana baru tahu ne, tks bro

    <a href="wisataumrah.com/">Peluang Usaha</a>

  • hehehehe, ana baru tahu ne, tks bro

    http://wisataumrah.com/

  • tks for information, i can do

    <a href="joinsyariah.com

    http://joinsyariah.com/?id=001

  • Thanks - This saved a bunch of time.

  • Thanks for doing this.  It's a heck of lot more straight forward than any other method I've seen (e.g. support.microsoft.com/.../2915218 ).  I put a comment at the bottom of that KB saying they should simply use your method if you are a sysadmin.  The method in the KB article is ok if you are automating the process.  However, many sysadmins dis-allow any kind of scripting on a production server which is a problem if you need to run a PS script.

    Thanks again!

  • travelumrohjakarta.weebly.com

Page 1 of 1 (11 items)