Unable to refresh the statistics in hangfire dashboard

Question

My website running with hangfire on the same server.

The hangfire dashboard runs well on local. However, while I access http://localhost/hangfire/recurring on the server computer, it reports this error:

Unable to refresh the statistics: the server responded with 500 (Internal Server Error). Try reloading the page manually, or wait for automatic reload that will happen in a minute.

I found out the problem on Chrome DevTools: The http://localhost/hangfire/stats returns a 500 (Internal Server Error).

Soon I found the logs about this:

2021-05-29 15:35:55.6185|7|ERROR|Microsoft.AspNetCore.Antiforgery.DefaultAntiforgery|An exception was thrown while deserializing the token. Microsoft.AspNetCore.Antiforgery.AntiforgeryValidationException: The antiforgery token could not be decrypted.
 ---> System.Security.Cryptography.CryptographicException: The key {a2487e3b-0ba1-4f7f-9679-8721bb79278e} was not found in the key ring.
   at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector.UnprotectCore(Byte[] protectedData, Boolean allowOperationsOnRevokedKeys, UnprotectStatus& status)
   at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector.DangerousUnprotect(Byte[] protectedData, Boolean ignoreRevocationErrors, Boolean& requiresMigration, Boolean& wasRevoked)
   at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector.Unprotect(Byte[] protectedData)
   at Microsoft.AspNetCore.Antiforgery.DefaultAntiforgeryTokenSerializer.Deserialize(String serializedToken)
   --- End of inner exception stack trace ---
   at Microsoft.AspNetCore.Antiforgery.DefaultAntiforgeryTokenSerializer.Deserialize(String serializedToken)
   at Microsoft.AspNetCore.Antiforgery.DefaultAntiforgery.GetCookieTokenDoesNotThrow(HttpContext httpContext)
2021-05-29 15:35:55.6185|1|ERROR|Microsoft.AspNetCore.Diagnostics.ExceptionHandlerMiddleware|An unhandled exception has occurred while executing the request. System.ArgumentNullException: The required antiforgery cookie token must be provided. (Parameter 'cookieToken')
   at Microsoft.AspNetCore.Antiforgery.DefaultAntiforgeryTokenGenerator.TryValidateTokenSet(HttpContext httpContext, AntiforgeryToken cookieToken, AntiforgeryToken requestToken, String& message)
   at Microsoft.AspNetCore.Antiforgery.DefaultAntiforgery.IsRequestValidAsync(HttpContext httpContext)
   at Hangfire.Dashboard.AspNetCoreDashboardMiddleware.Invoke(HttpContext httpContext)
   at Microsoft.AspNetCore.Builder.Extensions.MapMiddleware.Invoke(HttpContext context)
   at Sample.Middleware.LanguageCheckerMiddleware.Invoke(HttpContext context) in D:\Sample\Middleware\LanguageCheckerMiddleware.cs:line 55
   at Sample.Middleware.AdminBlackListMiddleware.Invoke(HttpContext context) in D:\Sample\Middleware\AdminBlackListMiddleware.cs:line 69
   at Microsoft.AspNetCore.Diagnostics.StatusCodePagesMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Localization.RequestLocalizationMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Diagnostics.ExceptionHandlerMiddleware.<Invoke>g__Awaited|6_0(ExceptionHandlerMiddleware middleware, HttpContext context, Task task)

I have added these code in each public async Task Invoke(HttpContext context) of the middleware to prevent it block the hangfire but the problem still here:

if (context.Request.Host.Host.ToLower() == "localhost")
            {
                await _next.Invoke(context);
                return;
            }

How can I solve this? Thank you.

Bluff

Does this help github.com/HangfireIO/Hangfire/issues/… ? – Haslet

@Haslet yeah, it works now! – Bluff

You should post an answer to your own question and accept it. So that the question does not appear unanswered – Haslet

Answer 1

Add this in startup.cs:

app.UseHangfireDashboard("/hangfire", new DashboardOptions
            {
                Authorization = new[] {new HangfireAuthFilter()},
                IgnoreAntiforgeryToken = true                                 // <--This
            });

And now it works.

Bluff

Answer 2

If you are calling Hangfire from within your Configure method in Startup.cs, the below code will bypass the error by skipping the IgnoreAntiforgeryToken check.

However it should be noted that this will make Hangfire a little less secure.

    app.UseEndpoints(endpoints =>
    {
        endpoints.MapControllerRoute(
            name: "default",
            pattern: "{controller=Home}/{action=Index}/{id?}");
        endpoints.MapRazorPages();
        endpoints.MapHangfireDashboard("/hangfire", new DashboardOptions
        {
            Authorization = new[] { new HangfireAuthorizationFilter() },
            IgnoreAntiforgeryToken = true
        });
    });

Isolecithal

Answer 3

You need to pass DashboardOptions value to endpoints.MapHangfireDashboard() as to app.UseHangfireDashboard()

Macaronic