Padding is invalid and cannot be removed

10. October 2009 13:14 by arnoldbo in General  //  Tags: , ,   //   Comments

After deploying my asp.net site to a webhosting company I suddenly was faced with error's when requesting WebResource.axd.

The following error occured:
Padding is invalid and cannot be removed.

Stacktrace:    at System.Security.Cryptography.RijndaelManagedTransform.DecryptData(Byte[] inputBuffer, Int32 inputOffset, Int32 inputCount, Byte[]& outputBuffer, Int32 outputOffset, PaddingMode paddingMode, Boolean fLast)
   at System.Security.Cryptography.RijndaelManagedTransform.TransformFinalBlock(Byte[] inputBuffer, Int32 inputOffset, Int32 inputCount)
   at System.Security.Cryptography.CryptoStream.FlushFinalBlock()
   at System.Web.Configuration.MachineKeySection.EncryptOrDecryptData(Boolean fEncrypt, Byte[] buf, Byte[] modifier, Int32 start, Int32 length, IVType ivType, Boolean useValidationSymAlgo)
   at System.Web.UI.Page.DecryptStringWithIV(String s, IVType ivType)
   at System.Web.UI.Page.DecryptString(String s)
   at System.Web.Handlers.ScriptResourceHandler.DecryptParameter(NameValueCollection queryString)


The solution for this problem for me was to set a fixed machine key in the web.config file.
For this you can use a machineKey generator or generate your own if you know how to do it (random chars will not work).

  <system.web>
    <machineKey    validationKey='A06BDCF2F6CF.A.VERY.LONG.44F13E76184945A7C477601'
        decryptionKey='99079B21C2F3644.A.BIT.SHORTER.BB81C7E9D58378'
        validation='SHA1'/>
  </system.web>


For more detailed information you can read the blog post from José Antonio