"Error occurred during a cryptographic operation" when decrypting Forms cookie

Question

I've uploaded my website to a webhosting and this error came up;
'Error occurred during a cryptographic operation.'.

I've done some research and it seems that the formauthenticated cookie is bound to the MachineKey (which differs when using webhost).

I've found a method that should fix this problem but the error remains.

CODE:

/// <summary>
    /// This method removes a cookie if the machine key is different than the one that saved the cookie;
    /// </summary>
    protected void Application_Error(object sender, EventArgs e)
    {
        var error = Server.GetLastError();
        var cryptoEx = error as CryptographicException;
        if (cryptoEx != null)
        {
            FederatedAuthentication.WSFederationAuthenticationModule.SignOut();
            Global.Cookies.FormAuthenticated Cookie = new Global.Cookies.FormAuthenticated();
            Cookie.Delete();
            Server.ClearError();
        }
    }

STACKTRACE:

[CryptographicException: Error occurred during a cryptographic operation.]
   System.Web.Security.Cryptography.HomogenizingCryptoServiceWrapper.HomogenizeErrors(Func`2 func, Byte[] input) +115
   System.Web.Security.Cryptography.HomogenizingCryptoServiceWrapper.Unprotect(Byte[] protectedData) +59
   System.Web.Security.FormsAuthentication.Decrypt(String encryptedTicket) +9824926
   Archive_Template.Main.resolveLoginUser(String sessionKey) in f:\Archive_Template\Archive_Template\Main.aspx.cs:481
   Archive_Template.Main.OnPreInit(EventArgs e) in f:\Archive_Template\Archive_Template\Main.aspx.cs:52
   System.Web.UI.Page.PerformPreInit() +31
   System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +335

If you're using server-side ADAL libraries from Microsoft, see @FRoZeN's answer (delete the cached tokens from you SQL 'UserTokenCaches' table) — bkwdesign, Oct 05 '17 at 13:02
If you're doing client side scripting / SPA development, see @BaqerNaqvi's answer - clearing your browser's localStorage where ADAL.js is storing and caching it's API access tokens should help resolve things — bkwdesign, Oct 05 '17 at 13:05

score 37 · Answer 1 · answered Jul 19 '16 at 14:40

37

I faced the same problem. I just cleared all of browser's cookies and cache data and it got fixed.I hope it will work for you too.

answered Jul 19 '16 at 14:40

Baqer Naqvi

6,011
3
50
68

1

Thanks! Fixed my issue – Obakeng Molebatsi Sep 26 '18 at 12:42
1

I also ran into this issue and clearing cookies worked. The Stack Trace message had a lot of calls regarding session security and session authentication. Cookies was definitely the issue! – Chioke Aarhus Apr 20 '21 at 19:02
1

Many thanks, it worked like a magic. I was stuck since two days due to this. I should've checked it on stackoverflow first :D – Muhammad Ashhar Hasan Dec 23 '22 at 07:45

score 36 · Accepted Answer · answered Sep 15 '15 at 14:33

36

For anyone who hasn't solved their problem, I was missing the "machineKey" entry for encrypt/decrypt in my web.config

answered Sep 15 '15 at 14:33

Grace

2,548
5
26
23

3

Can you expand on this answer? What particular config did you use? Can this be configured with iis? – AntonJ Aug 03 '16 at 13:03
You can add something like this inside the system.web section in the WebConfig. However, that does not fix the issue permanently. check the comments in http://stackoverflow.com/questions/14119965/federated-authentication-on-azure and for the IIS https://blogs.msdn.microsoft.com/amb/2012/07/31/easiest-way-to-generate-machinekey/ – Juan Acosta Apr 28 '17 at 00:29
I had this issue moving a site into a web farm with two web servers. This answer, using Juan Acosta's link, plus clearing the cached data and cookies for this site only (I did this using the browser developer tools), as suggested by andreasnico's answer, solved the problem. Thank you. – Michael Russ Jan 21 '20 at 20:15

score 20 · Answer 3 · answered Oct 05 '14 at 17:02

20

If you are using forms auth. you can signout when you catch the exception and allow your users to login and create a valid cookie

catch (CryptographicException cex)
{
    FormsAuthentication.SignOut();
}

answered Oct 05 '14 at 17:02

Ozan BAYRAM

2,780
1
28
35

3

Hello, I have the same problem, can you tell me where should I put this code in my controllers to catch this error? – Eru May 18 '15 at 14:18
1

On your `Global.asax` file – hiFI Nov 11 '16 at 03:29
We are facing this issue at login for some users only – Adeem Jun 07 '23 at 10:40
Place this code where you create your authentication cookie(s). – Ozan BAYRAM Jun 07 '23 at 11:40

score 9 · Answer 4 · answered Jan 23 '17 at 07:29

9

I just had this aswell, i deleted the UserTokenCaches table entries from the database.

answered Jan 23 '17 at 07:29

Jim Wolff

5,052
5
34
44

Yes, for users of the ADAL libraries from Microsoft.. delete your tokens cached in the database.. just like @FRoZeN says here – bkwdesign Oct 05 '17 at 13:00

score 8 · Answer 5 · edited Mar 12 '15 at 10:53

8

This is due to the machine key is missing, which is used as a symmetric key to do the encryption and decryption.

To set the machine in the IIS;

Go to your application -> Machine Keys -> Generate Keys

edited Mar 12 '15 at 10:53

Alex

11,115
12
51
64

answered Mar 12 '15 at 10:32

Ghaleb Badran

91
1
2

score 8 · Answer 6 · answered Nov 23 '16 at 18:46

I ran into this problem when I tried to take a forms authentication cookie created by an ASP.NET 2.0 app and decrypt it inside an .NET4.5 Web API project. The solution was to add an attribute called "compatibilityMode" to the "machineKey" node inside my web api's web.config file:

<machineKey 
...
compatibilityMode="Framework20SP2"/>

Documentation: https://msdn.microsoft.com/en-us/library/system.web.configuration.machinekeysection.compatibilitymode.aspx

And from the doc, here are the allowed values for that attribute:

Framework20SP1. This value specifies that ASP.NET uses encryption methods that were available in versions of ASP.NET earlier than 2.0 SP2. Use this value for all servers in a web farm if any server has a version of the .NET Framework earlier than 2.0 SP2. This is the default value unless the application Web.config file has the targetFramework attribute of the httpRuntime element set to "4.5".
Framework20SP2. This value specifies that ASP.NET uses upgraded encryption methods that were introduced in the .NET Framework 2.0 SP2. Use this value for all servers in a web farm if all servers have the .NET Framework 2.0 SP2 or later but at least one does not have the .NET Framework 4.5.
Framework45. Cryptographic enhancements for ASP.NET 4.5 are in effect. This is the default value if the application Web.config file has the targetFramework attribute of the httpRuntime element set to "4.5".

This, coupled with the solution to this: https://stackoverflow.com/questions/16660900/webforms-unobtrusivevalidationmode-requires-a-scriptresourcemapping-for-jquery/16705149#16705149, solved my problem. Thanks! — RossD, Feb 15 '18 at 18:11

score 7 · Answer 7 · answered Feb 23 '18 at 08:59

7

Another option is to clear the cookies from browser setting and this allows new cookies to get stored.

answered Feb 23 '18 at 08:59

Manoj Patil

970
1
10
19

Closed all my browser, open a new one and this issue is gone – Esen Aug 22 '18 at 12:14

score 6 · Answer 8 · answered Dec 04 '15 at 07:22

6

I have also experienced this when developing a new solution and running the website on localhost. Setting the machinekey made no difference, but simply deleting all the cookies for localhost solved the problem.

answered Dec 04 '15 at 07:22

andreasnico

1,478
14
23

score 5 · Answer 9 · answered Aug 31 '17 at 13:12

       protected void Application_Error(object sender_, CommandEventArgs e_)
    {
        Exception exception = Server.GetLastError();
        if(exception is CryptographicException)
        {
            FormsAuthentication.SignOut();
        }
    }

in your Global.asax.cs, from Catching errors in Global.asax, as long as you use Forms authentication (login/password). Worked for me.

score 2 · Answer 10 · answered Jun 29 '16 at 05:48

2

If you receive this error when implementing single sign on (as described here http://www.alexboyang.com/2014/05/28/sso-for-asp-net-mvc4-and-mvc5-web-apps-shared-the-same-domain/), make sure to have the same target framework across all projects. I had one project with .NET 4.0 and the other on .NET 4.5.2.

Changing the first one to 4.5.2 fixed the issue for me.

answered Jun 29 '16 at 05:48

SzilardD

1,611
2
22
40

Going to the Project and specifying .Net 4.5.2 again seemed to fix the issue for me, as well. – AdamantineWolverine Apr 03 '18 at 11:08

score 2 · Answer 11 · answered Apr 03 '18 at 11:31

I was getting crypto errors when validating the AntiForgery token.

I believe it was because I had just made some security control configuration changes to my server to configure application recycling to recycle when Virtual Memory limits hit 1,000,000 Kilobytes.

This was definitely way too little for virtual memory recycling. Private memory usage can be set to 1,000,000 KB, but virtual memory should be given a lot more space.

I noticed my application was recycling much too often.

I increased the Virtual Memory limit to 10,000,000 KB and those errors went away. I believe the application pool may have been recycling as I was filling out the form.

score 1 · Answer 12 · answered May 18 '20 at 11:43

For me, It was the <httpRuntime targetFramework="4.7.2"/> causing the compatibilty issues.My application was not using targetFramework="4.7.2" parameter in <httpRuntime targetFramework="4.7.2"/> in the web.config while the webApi was using <httpRuntime targetFramework="4.7.2"/> .Removing the paramater from the WebApi or adding the paramater in the Application did the trick.

score 0 · Answer 13 · answered Jun 10 '17 at 18:13

I had the same issue: MVC 5 ASP.Net Web Application .net Framework 4.6.1

Solution:

Go to App_Data folder (Solution explorer)
Double click in your NAME.mdf (this action open Server Explorer Tab)
Right click on UserTokenCaches table and view Show Table Data
Delete the row
Run app again and everything will be ok

score 0 · Answer 14 · answered Dec 01 '20 at 14:41

I had this problem when somebody decided to change the encryption algorithm to DES (a very old standard of encryption). Moving it back to AES (a more modern encryption standard) cleared the error.

Might have been something to do with Group Policy disabling DES...

The encryption algorithm is hidden in the Machine Key section (with IIS). There's probably a way of setting it in the web.config also.

"Error occurred during a cryptographic operation" when decrypting Forms cookie

14 Answers14

Linked