Is my car key auto-generated or isolated?

Question

I am trying to pass .ASPXAUTH cookies between an ASP.NET MVC 4 application (in IIS 7.5) and a service using an HttpListener on the same host.

The browser displays cookies as correctly, but my service receives a System.Web.HttpException: Unable to validate data. in FormsAuthentication.Decrypt , what I expect if two applications use different machine keys.

So: how do I know if my computer is configured to use different machine keys?

Answer 1

the default setting for IIS is auto-generation of a machine key and allocation for each application, you can change this globaly setting in the machine.config file or localy (for each application) in the web.config file

See details

• http://technet.microsoft.com/en-us/library/cc772287(v=ws.10).aspx
• http://technet.microsoft.com/en-us/library/cc754909(v=ws.10).aspx

You can see the current setting for the machine key in IIS Manager. See http://blogs.msdn.com/b/amb/archive/2012/07/31/easiest-way-to-generate-machinekey.aspx for details