19

Using ASP.Net MVC v2.0, I am starting to research the use of the Html.AntiForgeryToken() method when submitting forms that process data. I can see it sets a hidden value in the form HTML and it sets the same value in a session cookie.

The question is will different web servers in a load balanced configuration create the same token in the HTML forms? It seems if they don't then the cookie and hidden form value wouldn't match and we would have a problem. Before I get into actually testing this in a LB configuration, wanted to check if anyone already has experience with this?

Thanks, Paul

Paul Fryer
  • 9,268
  • 14
  • 61
  • 93

1 Answers1

23

If all machines across the farm share the same <machineKey>, everything will work. There are lots of resources on how to set this. There's also a tutorial on MSDN.

Note that the name <machineKey> is a bit misleading, since this is actually set per-application in ~/Web.config. So set the <machineKey> explicitly in your app's Web.config, then deploy across your farm.

Amirhossein Mehrvarzi
  • 18,024
  • 7
  • 45
  • 70
Levi
  • 32,628
  • 3
  • 87
  • 88
  • OK, I should have assumed the machineKey was used. Thanks for the answer. – Paul Fryer Aug 06 '10 at 17:50
  • 1
    And if your lazy to create a machinekey line for your config file: http://aspnetresources.com/tools/machineKey – bytedev Dec 06 '12 at 15:20
  • 1
    nashwan, it's dangerous to use a machineKey that you didn't generate yourself. It could end up compromising the security of your site. – Levi Mar 14 '14 at 16:19
  • we generated machine key and added in web.config file. This issue occurred in one server scenario also – Nash Jan 21 '16 at 15:24