deploying AntiforgeryToken Error

Question

I am working on an ASP.NET MVC application on my local machine using the Visual Studio 2012 built in IISExpress. After a significant progress I decided to make it available across the Local network, I created a virtual directory from visual studio. I can log in but when I try to register a new user. I get the error below.

The anti-forgery token could not be decrypted. If this application is hosted by a Web Farm or cluster, ensure that all machines are running the same version of ASP.NET Web Pages and that the configuration specifies explicit encryption and validation keys. AutoGenerate cannot be used in a cluster.

I generated a new machine key from (ASPNET resources) and placed it in my configuration file but is not still working.Can someone suggest a solution?

Clepsydra

Please, stop referring to "ASP.NET MVC" simply as "MVC". One is a framework, while other is a language-independent design pattern. It's like calling IE - "the internet" – Bellini

While I'll agree that when searching the internet using "MVC" rather than "ASP.NET MVC" might cause you to spend alot of extra time getting to a solution.. but in this case one could just look at the SO Tag that was chosen for this question to understand what the OP was talking about. – Fite

It wouldn't hurt to see the asp.net mvc version number as well – Mencius

I had this issue in IE11, intermittently. I had two forms, each with its own token. I found that two cookies with the name __RequestVerificationToken were sent, with different values. Once I removed the cookies (all for the domain), the issues disappeared. I do not know why the cookies are there in the first place, and how they correspond to the form fields. – Midas

Answer 1

One thing I noticed is that this error could be caused by having multiple @Html.AntiForgeryToken() pieces of code on the page. I had 2 on my page and once I removed the second one, this error went away.

Tamar

I can confirm this happened to me also. – Sorghum

Me too. For me, the 2nd copy of the @Html.AntiForgeryToken() line was appearing via a partial view. I commented it out in the partial view and my login pages started working again. – Baldachin

I had this happen in IE9, where i had accidentally nested a FORM tag. Newer browsers were fine, but older ones were sending multiple tokens. (I had set jquery dialog to appendTo : #Main>form ) – Decompress

I have the same problem. I have indeed two @html.antiforgerytoken, but when I remove on of them (the one in partial view), the error still persist. What is more, even when I am running in localhost, it still gives me error. can you help me? – Salespeople

Yup, same here. I had one generated token in parent view, and one in the partial where the actual form elements where located. Thanks Louis for the hint! – Sizing

Answer 2

You should be adding a machine key that is unique to the website/machine combination. It is this machine key that the token generator uses. This means that you should generate a machine key (which you can do here (dead link-beware) and add it to your Web.config file on your machine. You can find more information here: http://msdn.microsoft.com/en-us/library/ff649308.aspx

You can also do this directly from within IIS: http://blogs.msdn.com/b/amb/archive/2012/07/31/easiest-way-to-generate-machinekey.aspx

Chlorate

Read my post, I already tried this earlier. I notice that I do not have Machine Key Icon in my IIS Manager panel. Can that be the problem? – Clepsydra

Yes, that could certainly be the problem. Perhaps you have placed the machineKey entry in the wrong place in your Web.config file. Could you post your Web.config so that we can see how and where you added it? – Chlorate

Answer 3

There I was able to find the answer http://iamdotnetcrazy.blogspot.ru/2013/08/how-to-solve-anti-forgery-token-could.html

Destrier

Answer 4

In my case this was an issue with the load balancer not having session persistance turned on for the site.

Leuco

Answer 5

I was having a page which was using the partial view. Both contained @Html.AntiForgeryToken() and on removing the @Html.AntiForgeryToken() from the partial page, it worked.

Tylertylosis