机器密钥更改后 ASPX 匿名 Cookie 被破坏
我的公司最近遇到了流量高峰，因此我们尝试启动额外的 EC2 实例来处理负载。不幸的是，这导致用户出现 cookie 问题（即，即使您提供了凭据，网站仍不断要求登录）。我们认为这是因为我们忽略了在 Web.config 文件中设置计算机密钥（每台负载平衡计算机上的 Web.config 文件在其他方面都是相同的）。
我们现在不想在 Web.config 中设置新的机器密钥值，因为这会注销所有匿名用户，他们可能已经将商品添加到购物车等。但是我们还想支持缩放。
那么，问题是：
- 我们的假设是否正确，即机器密钥是用户需要新 cookie 的罪魁祸首？
- 有没有什么方法可以确定正在使用的当前或默认机器密钥，以便我们可以将其复制到其他负载平衡服务器？
- 失败2，有没有办法设置新的机器密钥而不丢失我们的匿名用户的数据？
My company recently got hit with a traffic spike, so we tried to fire up additional EC2 instances to handle the load. Unfortunately, this caused users problems with cookies (i.e. site kept asking for login even after you supplied credentials). We think this is because we had neglected to set the Machine Key in our Web.config file (the Web.config files on each load balanced machine are otherwise identical).
We're now in the position where we don't want to set a new Machine Key value in Web.config, because that will log out all of our anonymous users, who may have already added items to their cart, etc. But we also want to support scaling.
So, questions:
- Is our assumption correct that the Machine Key is the culprit for user's needing new cookies?
- Is there any way of determining the current or default Machine Key that is being used so that we can copy it to the other load balanced servers?
- Failing 2, is there a way to set a new Machine Key without losing our anonymous user's data?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您没有提到您正在使用什么身份验证方法，但如果是表单身份验证，那么是的 - 您的计算机密钥需要在场中的所有服务器之间匹配。您还应该确保所有计算机都打了同样的补丁，因为有多个补丁（特别是 ASP.NET 安全漏洞更新）会更新加密位。
如果您使用默认配置，则机器密钥可能会设置为“自动生成”。据我所知，没有简单的方法可以揭示自动生成的机器密钥的设置。但是，由于您可以访问现有服务器，因此您可能可以通过一些反射代码找到它，如下所示：
http: //aspnetresources.com/blog/how_to_read_auto_ generated_machinekey
You didn't mention what method of authentiation you are using, but if it's forms authentication, then yes - your machine keys need to match across all servers in your farm. You should also make sure that all of your machines are equally patched as there have been several patches (specifically the asp.net security vulnerabilty updates) that update the cryptography bits.
If you're using the default configuration, the machine key is likey set to AutoGenerate. As far as I know, there is no simple way to reveal what the autogenerated machine key is set to. However, since you have access to your exising server, you can probably find it via a little reflection code as illustrated here:
http://aspnetresources.com/blog/how_to_read_auto_generated_machinekey