How to Configure MachineKey in ASP
MachineKey is a setting in the web.config file of a Microsoft web application. It adds encryption security to your website to protect the information entered by users on web forms. Using MachineKey in the web.config file creates a hash generated on the fly by the host server. If a person tries to tamper with the encrypted information, the server detects an invalid string and rejects the form's submission. Editing the web.config with a MachineKey value improves the safety of the host server and the user's information.
Other People Are Reading
Instructions
-
-
1
Open the web.config file in your web application. Web.config is located in the root folder of the solution. It is found by using the Solution Explorer in Visual Studio.
-
2
Type the MachineKey value tags within the system.web tags. The opening tag syntax is below:
<machineKey /> -
-
3
Add auto-generation of a new key for each application. The use of "AutoGenerate" instructs the server to generate a key automatically and the "IsolateApps" is the instruction for servers to generate a new key for each instance of the application. The following code is added to the MachineKey value:
<machineKey validationKey="AutoGenerate,IsolateApps" /> -
4
Add the type of validation. There are several different hashing types. A popular encryption generation code is SHA1, which produces a longer hash code than some of the older schemes such as MD5 and 3DES. The following code adds SHA1 hashing to the application:
<machineKey validationKey="AutoGenerate,IsolateApps" validation="SHA1" /> -
5
Add decryption modifiers. Just like the application needs encryption instructions, it also needs to be able to decrypt the submitted forms. The following modifiers are the final part of the MachineKey value:
<machineKey validationKey="AutoGenerate,IsolateApps" validation="SHA1" decryptionKey="AutoGenerate,IsolateApps" /> -
6
Save the web.config and close the file.
-
1
