I built a site that's running on a two load-balanced servers (web-farm), after a while I had to do the following:
at the login page, when the user enters user-name and pass, if the user is valid then I'm abandoning the session and creating a new one as follows:
protected void btnLogin_Click(object sender, EventArgs e)
{
var Token = Guid.Empty;
try
{
if (IsValidCaptcha())
{
string email = txtEmail.Text.Trim();
string pw = txtPassword.Text.Trim();
AbandonSession();//Delete any existing sessions
var newSessionId = CreateSessionId(HttpContext.Current); //Create a new SessionId
SetSessionId(HttpContext.Current, newSessionId);
Token = SecureLogin.Login(email, pw, LangCode);
}
else
{
lblMsg.Style.Add("display", "block");
}
}
catch (Exception)
{
Token = Guid.Empty;
lblMsg.Style.Add("display", "block");
}
if (Token != Guid.Empty)
{
Response.Redirect($"HiddenPage.aspx?token={Token.ToString()}", false);
}
else
{
lblMsg.Style.Add("display", "block");
}
}
protected void AbandonSession()
{
Session.Clear();
Session.Abandon();
Session.RemoveAll();
if (Request.Cookies["ASP.NET_SessionId"] != null)
{
Response.Cookies["ASP.NET_SessionId"].Value = string.Empty;
Response.Cookies["ASP.NET_SessionId"].Expires = DateTime.Now.AddMonths(-20);
}
if (Request.Cookies["__AntiXsrfToken"] != null)
{
Response.Cookies["__AntiXsrfToken"].Value = string.Empty;
Response.Cookies["__AntiXsrfToken"].Expires = DateTime.Now.AddMonths(-20);
}
}
private string CreateSessionId(HttpContext httpContext)
{
var manager = new SessionIDManager();
string newSessionId = manager.CreateSessionID(httpContext);
return newSessionId;
}
public void SetSessionId(HttpContext httpContext, string newSessionId)
{
try
{
var manager = new SessionIDManager();
manager.SaveSessionID(httpContext, newSessionId, out bool redirected, out bool cookieAdded);
}
catch(Exception ex)
{
SmtpMailer.SendMsg(ex.Message + ex.StackTrace + ex.InnerException, "", "");
}
}
This is one of the requirements for the site and I can't change it at all (changing the session after login to the site).
after applying this approach, I started getting this error almost in every page in the site (every now and then).
Event code: 4009
Event message: Viewstate verification failed.
Reason: The viewstate supplied failed integrity check.
Event time: 1/22/2019 2:53:36 PM
Event time (UTC): 1/22/2019 7:53:36 PM
Event ID: 5ffacfa116224c9f8f516ead8a89cc55
Event sequence: 378
Event occurrence: 1
Event detail code: 50203
Application information:
Application domain: /LM/W3SVC/2/ROOT-1-131926597583461452
Trust level: Full
Application Virtual Path: /
Application Path: ...........
Machine name: .............. Process information:
Process ID: 6624
Process name: w3wp.exe
Account name: IIS APPPOOL\.............. Request information:
Request URL: ............../qConsole/CampaignGroup-Launch.aspx
Request path: /qConsole/CampaignGroup-Launch.aspx
User host address: ..............
User:
Is authenticated: False
Authentication Type:
Thread account name: IIS APPPOOL\..............
I double checked (a) the machine key /decryption key is the same on both servers in load balancing, and (b) that they are not set to auto generate
and also I added this code to Global.asax
protected void Session_Start(object sender, EventArgs e)
{
Session.Timeout = 60;
}
and I have this set in the web.config file
<sessionState timeout="25" />
I have a feeling that the issue I'm having revolves around the feature I added (creating new sessionId after the login page), any ideas or thoughts are really appreciated.
Update:
i tried this and it didn't solve at all
Viewstate verification failed. Reason: The viewstate supplied failed integrity check.
Thanks.