User-924931093 posted
I built a site that's running on a two load-balanced servers (web-farm), after a while I had to do the following:
at the login page, when the user enters user-name and pass, if the user is valid then I'm abandoning the session and creating a new one as follows:
protected void btnLogin_Click(object sender, EventArgs e)
{
var Token = Guid.Empty;
try
{
if (IsValidCaptcha())
{
string email = txtEmail.Text.Trim();
string pw = txtPassword.Text.Trim();
AbandonSession();//Delete any existing sessions
var newSessionId = CreateSessionId(HttpContext.Current); //Create a new SessionId
SetSessionId(HttpContext.Current, newSessionId);
Token = SecureLogin.Login(email, pw, LangCode);
}
else
{
lblMsg.Style.Add("display", "block");
}
}
catch (Exception)
{
Token = Guid.Empty;
lblMsg.Style.Add("display", "block");
}
if (Token != Guid.Empty)
{
Response.Redirect($"HiddenPage.aspx?token={Token.ToString()}", false);
}
else
{
lblMsg.Style.Add("display", "block");
}
}
protected void AbandonSession()
{
Session.Clear();
Session.Abandon();
Session.RemoveAll();
if (Request.Cookies["ASP.NET_SessionId"] != null)
{
Response.Cookies["ASP.NET_SessionId"].Value = string.Empty;
Response.Cookies["ASP.NET_SessionId"].Expires = DateTime.Now.AddMonths(-20);
}
if (Request.Cookies["__AntiXsrfToken"] != null)
{
Response.Cookies["__AntiXsrfToken"].Value = string.Empty;
Response.Cookies["__AntiXsrfToken"].Expires = DateTime.Now.AddMonths(-20);
}
}
private string CreateSessionId(HttpContext httpContext)
{
var manager = new SessionIDManager();
string newSessionId = manager.CreateSessionID(httpContext);
return newSessionId;
}
public void SetSessionId(HttpContext httpContext, string newSessionId)
{
try
{
var manager = new SessionIDManager();
manager.SaveSessionID(httpContext, newSessionId, out bool redirected, out bool cookieAdded);
}
catch(Exception ex)
{
SmtpMailer.SendMsg(ex.Message + ex.StackTrace + ex.InnerException, "", "");
}
}
This is one of the requirements for the site and I can't change it at all (changing the session after login to the site).
after applying this approach, I started getting this error almost in every page in the site (every now and then).
Event code: 4009
Event message: Viewstate verification failed.
Reason: The viewstate supplied failed integrity check.
Event time: 1/22/2019 2:53:36 PM
Event time (UTC): 1/22/2019 7:53:36 PM
Event ID: 5ffacfa116224c9f8f516ead8a89cc55
Event sequence: 378
Event occurrence: 1
Event detail code: 50203
Application information:
Application domain: /LM/W3SVC/2/ROOT-1-131926597583461452
Trust level: Full
Application Virtual Path: /
Application Path: ...........
Machine name: .............. Process information:
Process ID: 6624
Process name: w3wp.exe
Account name: IIS APPPOOL\.............. Request information:
Request URL: ............../qConsole/CampaignGroup-Launch.aspx
Request path: /qConsole/CampaignGroup-Launch.aspx
User host address: ..............
User:
Is authenticated: False
Authentication Type:
Thread account name: IIS APPPOOL\..............
I double checked (a) the machine key /decryption key is the same on both servers in load balancing, and (b) that they are not set to auto generate
and also I added this code to Global.asax
protected void Session_Start(object sender, EventArgs e)
{
Session.Timeout = 60;
}
and I have this set in the web.config file
<sessionState timeout="25" />
Important Note: I'm using anti xsrf tokens in the Master Page to protect against xsrf, and it's using ViewState variables as following:
protected void Page_Init(object sender, EventArgs e)
{
if (Session["CurrentUser"] == null)
{
Response.Redirect("/");
}
//protect against XSRF attacks
var requestCookie = Request.Cookies[AntiXsrfTokenKey];
Guid requestCookieGuidValue;
if (requestCookie != null && Guid.TryParse(requestCookie.Value, out requestCookieGuidValue))
{
// Use the Anti-XSRF token from the cookie
_antiXsrfTokenValue = requestCookie.Value;
Page.ViewStateUserKey = _antiXsrfTokenValue;
}
else
{
// Generate a new Anti-XSRF token and save to the cookie
_antiXsrfTokenValue = GenNewId();
Page.ViewStateUserKey = _antiXsrfTokenValue;
var responseCookie = new HttpCookie(AntiXsrfTokenKey)
{
HttpOnly = true,
Value = _antiXsrfTokenValue,
Expires = DateTime.Now.AddMinutes(10.0)
};
if (FormsAuthentication.RequireSSL && Request.IsSecureConnection)
{
responseCookie.Secure = true;
}
Response.Cookies.Set(responseCookie);
}
Page.PreLoad += master_Page_PreLoad;
}
Here where I'm getting the error and being redirected to the Error page:
protected void master_Page_PreLoad(object sender, EventArgs e)
{
try
{
if (!IsPostBack)
{
// Set Anti-XSRF token
ViewState[AntiXsrfTokenKey] = Page.ViewStateUserKey;
ViewState[AntiXsrfUserNameKey] = Session.SessionID.ToString();
}
else
{
// Validate the Anti-XSRF token
if ((string)ViewState[AntiXsrfTokenKey] != _antiXsrfTokenValue
|| (string)ViewState[AntiXsrfUserNameKey] != Session.SessionID)
{
Response.Redirect("/Error");
}
}
}
catch (Exception ex)
{
SmtpMailer.SendMsg(ex.Message + ex.Source + ex.StackTrace);
}
}
I have a feeling that the issue I'm having revolves around the feature I added (creating new session-id after the login page), any ideas or thoughts are really appreciated.
Thanks
Does Anti XSRF Tokens or Session ID affects ViewState validation?
