The antiforgery token could not be decrypted - Only for specific user
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 10h
- Merged PRs (30d)
- 281
Description
### Is there an existing issue for this?
- [X] I have searched the existing issues
### Describe the bug
```
An exception was thrown while deserializing the token.
Microsoft.AspNetCore.Antiforgery.AntiforgeryValidationException: The antiforgery token could not be decrypted.
---> System.Security.Cryptography.CryptographicException: The key {669d513e-a172-4851-b160-04b523abbc1e} was not found in the key ring.
at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector.UnprotectCore(Byte[] protectedData, Boolean allowOperationsOnRevokedKeys, UnprotectStatus& status)
at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector.DangerousUnprotect(Byte[] protectedData, Boolean ignoreRevocationErrors, Boolean& requiresMigration, Boolean& wasRevoked)
at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector.Unprotect(Byte[] protectedData)
at Microsoft.AspNetCore.Antiforgery.DefaultAntiforgeryTokenSerializer.Deserialize(String serializedToken)
--- End of inner exception stack trace ---
at Microsoft.AspNetCore.Antiforgery.DefaultAntiforgeryTokenSerializer.Deserialize(String serializedToken)
at Microsoft.AspNetCore.Antiforgery.DefaultAntiforgery.GetCookieTokenDoesNotThrow(HttpContext httpContext)
```
We insert an anti-forgery token into the form using `@Html.AntiForgeryToken()` and validate the request using the ` [ValidateAntiForgeryToken]`, however we occasionally get the error above when one user tries to submit.
How is the key generated? Why does the user affect the generation of the token?
### Expected Behavior
When user submit a form, the request token is valid and the user request is accepted.
### Steps To Reproduce
1. Create a cshtml page
2. Include an antiforgery token in the form using `@Html.AntiForgeryToken()`
3. Annotate the controller method with `[ValidateAntiForgeryToken]`
4. Make a post request with the token
### Exceptions (if any)
An exception was thrown while deserializing the token.
Microsoft.AspNetCore.Antiforgery.AntiforgeryValidationException: The antiforgery token could not be decrypted.
### .NET Version
netcoreapp3.1
### Anything else?
We have tried this with different users, different devices and different browsers.
Only this user has the issue, and it is correlated with the logs' timestamp.
I've checked the source code, and was wondering could it be due to special characters in the user name?
https://github.com/dotnet/aspnetcore/blob/main/src/Antiforgery/src/Internal/DefaultAntiforgeryTokenGenerator.cs
_No response_
Contributor guide
Research direction
Start with src/Antiforgery/src/Internal/DefaultAntiforgeryTokenGenerator.cs and the reported antiforgery reproduction steps. Trace the Data Protection key-ring failure shown in the exception and compare it with the user-specific behavior. Done means identifying a reproducible cause and documenting the appropriate fix or guidance.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100