dotnet / dotnet/aspnetcore

The antiforgery token could not be decrypted - Only for specific user

Open
#47,185 45 comments 4 reactions 0 assignees View on GitHub
area-dataprotection
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 10h
Merged PRs (30d)
281

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Describe the bug

```
An exception was thrown while deserializing the token.
Microsoft.AspNetCore.Antiforgery.AntiforgeryValidationException: The antiforgery token could not be decrypted.
---> System.Security.Cryptography.CryptographicException: The key {669d513e-a172-4851-b160-04b523abbc1e} was not found in the key ring.
   at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector.UnprotectCore(Byte[] protectedData, Boolean allowOperationsOnRevokedKeys, UnprotectStatus& status)
   at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector.DangerousUnprotect(Byte[] protectedData, Boolean ignoreRevocationErrors, Boolean& requiresMigration, Boolean& wasRevoked)
   at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector.Unprotect(Byte[] protectedData)
   at Microsoft.AspNetCore.Antiforgery.DefaultAntiforgeryTokenSerializer.Deserialize(String serializedToken)
   --- End of inner exception stack trace ---
   at Microsoft.AspNetCore.Antiforgery.DefaultAntiforgeryTokenSerializer.Deserialize(String serializedToken)
   at Microsoft.AspNetCore.Antiforgery.DefaultAntiforgery.GetCookieTokenDoesNotThrow(HttpContext httpContext)

```

We insert an anti-forgery token into the form using `@Html.AntiForgeryToken()` and validate the request using the ` [ValidateAntiForgeryToken]`, however we occasionally get the error above when one user tries to submit.

How is the key generated? Why does the user affect the generation of the token?

### Expected Behavior

When user submit a form, the request token is valid and the user request is accepted.

### Steps To Reproduce

1. Create a cshtml page
2. Include an antiforgery token in the form using `@Html.AntiForgeryToken()`
3. Annotate the controller method with `[ValidateAntiForgeryToken]`
4. Make a post request with the token

### Exceptions (if any)

An exception was thrown while deserializing the token.
Microsoft.AspNetCore.Antiforgery.AntiforgeryValidationException: The antiforgery token could not be decrypted.

### .NET Version

netcoreapp3.1

### Anything else?

We have tried this with different users, different devices and different browsers.

Only this user has the issue, and it is correlated with the logs' timestamp.

I've checked the source code, and was wondering could it be due to special characters in the user name?

https://github.com/dotnet/aspnetcore/blob/main/src/Antiforgery/src/Internal/DefaultAntiforgeryTokenGenerator.cs
_No response_

Contributor guide

Open the contributing guide

Research direction

Start with src/Antiforgery/src/Internal/DefaultAntiforgeryTokenGenerator.cs and the reported antiforgery reproduction steps. Trace the Data Protection key-ring failure shown in the exception and compare it with the user-specific behavior. Done means identifying a reproducible cause and documenting the appropriate fix or guidance.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.