ASP.NET 中自动生成机器密钥
默认情况下，机器密钥设置为自动生成和每个应用程序（AutoGenerate、IsolateApps）。 MSDN 指出解密密钥和验证密钥基于 Web 应用程序 ID。我在 IIS 7 服务器上托管两个 ASP.NET MVC 2 站点，但发现机器密钥是相同的。我通过使用反射查看 ValidationKeyInternal 和 DecryptionKeyInternal 属性来验证这一点。我还通过在一个站点上生成防伪造令牌 cookie 并将其传递到另一个站点来测试它，并且可以读取该 cookie。
经过反复试验，我发现如果应用程序池身份发生变化，密钥也会发生变化。这两个站点具有相同的密钥，因为它们在网络服务凭据下运行。一旦我更改一个站点的应用程序池标识，它们就开始具有不同的验证/加密密钥。
但是，在我将两个站点部署到另一台服务器后，即使在更改应用程序池标识后，我也始终获得相同的计算机密钥。两台服务器的硬件和软件配置相同。
我想知道在 AutoGenerate,IsolateApps 设置下如何生成机器密钥的实际逻辑是否有参考。在网络上，有很多文章讨论在网络场场景中设置相同的计算机密钥。但我却遇到了相反的问题。每个 Web 应用程序自动密钥生成似乎无法正常工作。以前有人遇到过同样的问题吗？
By default, the machine key setting is auto generate and per application (AutoGenerate,IsolateApps). MSDN states that the decryption key and validation key is based on web application id. I am hosting two ASP.NET MVC 2 sites on my IIS 7 server but found out that the machine key are the same. I verified this by using reflection to see the ValidationKeyInternal and DecryptionKeyInternal property. I also tested it by generating an anti forgery token cookie on one site and pass it to the other and the cookie can be read.
After trial and error, I found the key will change if the application pool identity changes. The two sites have the same keys because they are running under network service credential. Once I change the application pool identity of one site, they begin to have different validation/encryption keys.
However, after I deploy the two sites to another server, I always get the same machine keys even after changing application pool identity. The two servers have the same hardware and software configuration.
I would like to know if there is reference for the actual logic of how the machine key is generated under AutoGenerate,IsolateApps setting. On the web, there are a lot of articles talking about setting the same machine key in a web farm scenario. But I encountered a problem on the opposite side. The per web application auto key generation does not seem to work properly. Is there anyone who has the same problem before?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您是否有可能覆盖 IIS 设置的 web.config 设置？这可能是其中的一个因素，就好像您告诉服务器使用特定的密钥一样，他们可能会这样做。
Do you have a web.config setting that may be overriding the IIS setting? That could be a factor in this as if you are telling the servers to use specific keys then they may do just that.