The key was not found in the key ring. Unable to validate token

user_2595493 0
Viewed 10400

I am getting weird error on identity server 4 after I added NGNIX Proxy infront of my application.

  1. My .net core identity server is running on Docker Container on port 8080

  2. Ngnix proxy(using https://github.com/nginx-proxy/nginx-proxy) is configured to route 443 to docker container 8080

After successfully authenticate on callback endpoint it fails to validate the forgery token.

The weird part is the whole scenario works for user that I seed when the .net core app is started. But fails for new one created via my API.

Any idea or taught is appreciated.

identityserver4 docker .net
1 Answers

Your session cookie issued by ASP.NET core is encrypted using the Data Protection API.

The key used to sign the cookie is stored in a Key ring. If you now redeploy your application and if you haven't configured it correctly, then a new encryption key will be issued in a new key ring.

If the key that was used to encrypt the cookie can't be found, then this means that existing session cookie in the all clients browsers can't be decrypted anymore.

See this article about this API and this article about how to configure it.

This is both applicable to your IdentityServer and Client application as both uses the Data Protection API, so both needs to have a permanent key-ring in place. When you redeploy containers, the key-ring is lost unless you have placed the key-ring in some permanent volume on the file system or persisted it in some other way. The API supports many places to store the keyring, including database, redis, Azure Key Vault..

Andy_684900
Related