Strange Error in .net Application. - RijndaelManaged..

Question

During a recent load test, I've been getting some strange "Index Out of Range Exception"

Stack trace:

 at System.Security.Cryptography.RijndaelManagedTransform.DecryptData(Byte[] inputBuffer, Int32 inputOffset, Int32 inputCount, Byte[]& outputBuffer, Int32 outputOffset, PaddingMode paddingMode, Boolean fLast)
   at System.Security.Cryptography.RijndaelManagedTransform.TransformFinalBlock(Byte[] inputBuffer, Int32 inputOffset, Int32 inputCount)
   at System.Security.Cryptography.CryptoStream.FlushFinalBlock()
   at System.Web.Configuration.MachineKeySection.EncryptOrDecryptData(Boolean fEncrypt, Byte[] buf, Byte[] modifier, Int32 start, Int32 length, Boolean useValidationSymAlgo)
   at System.Web.UI.Page.DecryptString(String s)
   at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)

We are not using a farm or cluster, and I am not using any cryptography in the app.

It appears that this is happening in the behind the scenes .Net classes.

I figure this has something to do with viewstate, but I can't find out why this is being thrown.

Any Ideas?

Answer 1

Just a guess: have you disabled EventValidation on the site? Sounds like something is trying to create a manual postback or otherwise insert data directly into the http request's post data, and isn't calculated the correct value for the viewstate field. This in turn causes the decryption to fail spectacularly.

With EventValidation turned on you'll get an exception even if they calculate everything correctly, but at least it's a meaningful exception.

Answer 2

If someone initiates a post, the application starts sending the post with all 500KBs of viewstate. Half way through postback, the user gets bored and clicks something else. The browser cuts off the postback with just part of the viewstate. The server throws an error that says the viewstate is borked. I would guess this is a 2.0 application with the viewstate encryption feature turned on. The solution is to manage viewstate size more aggressively.

Event validation exceptions are more likely to happen when a malicious user is crafting a custom postback response, so I don't think event validation is involved here.