Exception - Padding is Invalid

[AG]

I occassionally get the following exception from an ASP.NET 2.0 Web
Application running on a shared web host.

I have no way of knowing what the actual request page was as it never
happens when I visit the site. The exception is trapped in the
Application_Err or event of global.asax and emailed to me.

The only encryption in the app is the connectionStrin gs section of
web.config.

There is no localization in use.

Can anyone shed any light on how to identify the root cause and correct it?

Could it be a server configuration problem?
Request.Path: /WebResource.axd

Exception Message: Padding is invalid and cannot be removed.

StackTrace: at
System.Security .Cryptography.R ijndaelManagedT ransform.Decryp tData(Byte[]
inputBuffer, Int32 inputOffset, Int32 inputCount, Byte[]& outputBuffer,
Int32 outputOffset, PaddingMode paddingMode, Boolean fLast)

at
System.Security .Cryptography.R ijndaelManagedT ransform.Transf ormFinalBlock(B yte[]
inputBuffer, Int32 inputOffset, Int32 inputCount)

at System.Security .Cryptography.C ryptoStream.Flu shFinalBlock()

at System.Web.Conf iguration.Machi neKeySection.En cryptOrDecryptD ata(Boolean
fEncrypt, Byte[] buf, Byte[] modifier, Int32 start, Int32 length, Boolean
useValidationSy mAlgo)

at System.Web.UI.P age.DecryptStri ng(String s)

at
System.Web.Hand lers.AssemblyRe sourceLoader.Sy stem.Web.IHttpH andler.ProcessR equest(HttpCont ext
context)

at
System.Web.Http Application.Cal lHandlerExecuti onStep.System.W eb.HttpApplicat ion.IExecutionS tep.Execute()

at System.Web.Http Application.Exe cuteStep(IExecu tionStep step, Boolean&
completedSynchr onously)

InnerException:

CurrentExecutio nFilePath: /WebResource.axd

--

AG
Email: discussATadhdat aDOTcom

[=?Utf-8?B?YnJ1Y2UgYmFya2Vy?=]

a webresource request has encrypted parameters (assembly name, and resource
id) so a user canot just randomly pluck out resources values (such as a
connect string). after encryption, the parameters are convereted to base64 to
make the strings url safe. due to base64's algrothrym a the string length is
always a mutilpe of three. to get this padding is added.

the error message means the parameter string was truncated (or has illegal
charaters) and does not match the url rendered. this is usally caused by a
proxy server that truncates the url because it too long, or performs some
other translation.

you would to run network traces to see if your end or the other end is
causing the problem.

-- bruce (sqlwork.com)
"AG" wrote:

I occassionally get the following exception from an ASP.NET 2.0 Web
Application running on a shared web host.

I have no way of knowing what the actual request page was as it never
happens when I visit the site. The exception is trapped in the
Application_Err or event of global.asax and emailed to me.

The only encryption in the app is the connectionStrin gs section of
web.config.

There is no localization in use.

Can anyone shed any light on how to identify the root cause and correct it?

Could it be a server configuration problem?
Request.Path: /WebResource.axd

Exception Message: Padding is invalid and cannot be removed.

StackTrace: at
System.Security .Cryptography.R ijndaelManagedT ransform.Decryp tData(Byte[]
inputBuffer, Int32 inputOffset, Int32 inputCount, Byte[]& outputBuffer,
Int32 outputOffset, PaddingMode paddingMode, Boolean fLast)

at
System.Security .Cryptography.R ijndaelManagedT ransform.Transf ormFinalBlock(B yte[]
inputBuffer, Int32 inputOffset, Int32 inputCount)

at System.Security .Cryptography.C ryptoStream.Flu shFinalBlock()

at System.Web.Conf iguration.Machi neKeySection.En cryptOrDecryptD ata(Boolean
fEncrypt, Byte[] buf, Byte[] modifier, Int32 start, Int32 length, Boolean
useValidationSy mAlgo)

at System.Web.UI.P age.DecryptStri ng(String s)

at
System.Web.Hand lers.AssemblyRe sourceLoader.Sy stem.Web.IHttpH andler.ProcessR equest(HttpCont ext
context)

at
System.Web.Http Application.Cal lHandlerExecuti onStep.System.W eb.HttpApplicat ion.IExecutionS tep.Execute()

at System.Web.Http Application.Exe cuteStep(IExecu tionStep step, Boolean&
completedSynchr onously)

InnerException:

CurrentExecutio nFilePath: /WebResource.axd

--

AG
Email: discussATadhdat aDOTcom

[AG]

Thanks Bruce,

Since I can't run any network traces, it sounds like I have to just ignore
it, unless it becomes more frequent.

--

AG
Email: discussATadhdat aDOTcom

"bruce barker" <br*********@di scussions.micro soft.comwrote in message
news:79******** *************** ***********@mic rosoft.com...

>a webresource request has encrypted parameters (assembly name, and resource
id) so a user canot just randomly pluck out resources values (such as a
connect string). after encryption, the parameters are convereted to base64
to
make the strings url safe. due to base64's algrothrym a the string length
is
always a mutilpe of three. to get this padding is added.

the error message means the parameter string was truncated (or has illegal
charaters) and does not match the url rendered. this is usally caused by a
proxy server that truncates the url because it too long, or performs some
other translation.

you would to run network traces to see if your end or the other end is
causing the problem.

-- bruce (sqlwork.com)
"AG" wrote:

>I occassionally get the following exception from an ASP.NET 2.0 Web
Application running on a shared web host.

I have no way of knowing what the actual request page was as it never
happens when I visit the site. The exception is trapped in the
Application_Er ror event of global.asax and emailed to me.

The only encryption in the app is the connectionStrin gs section of
web.config.

There is no localization in use.

Can anyone shed any light on how to identify the root cause and correct
it?

Could it be a server configuration problem?
Request.Path : /WebResource.axd

Exception Message: Padding is invalid and cannot be removed.

StackTrace: at
System.Securit y.Cryptography. RijndaelManaged Transform.Decry ptData(Byte[]
inputBuffer, Int32 inputOffset, Int32 inputCount, Byte[]& outputBuffer,
Int32 outputOffset, PaddingMode paddingMode, Boolean fLast)

at
System.Securit y.Cryptography. RijndaelManaged Transform.Trans formFinalBlock( Byte[]
inputBuffer, Int32 inputOffset, Int32 inputCount)

at System.Security .Cryptography.C ryptoStream.Flu shFinalBlock()

at
System.Web.Con figuration.Mach ineKeySection.E ncryptOrDecrypt Data(Boolean
fEncrypt, Byte[] buf, Byte[] modifier, Int32 start, Int32 length, Boolean
useValidationS ymAlgo)

at System.Web.UI.P age.DecryptStri ng(String s)

at
System.Web.Han dlers.AssemblyR esourceLoader.S ystem.Web.IHttp Handler.Process Request(HttpCon text
context)

at
System.Web.Htt pApplication.Ca llHandlerExecut ionStep.System. Web.HttpApplica tion.IExecution Step.Execute()

at System.Web.Http Application.Exe cuteStep(IExecu tionStep step, Boolean&
completedSynch ronously)

InnerException :

CurrentExecuti onFilePath: /WebResource.axd

--

AG
Email: discussATadhdat aDOTcom

[Steven Cheng[MSFT]]

Hi AG,

As for the WebResource.axd , it use machinekey to encrypt the
assembly/resource item parameters. by default, the machinekey of a .NET
application is randomly generated. Thus, if you're using webfarm or your
application will frequently restart due to some reason, you'll likely to
get such invalid exception when a former generated encryption parameter is
passed to webresource.axd .

One thing you can try is manually supply a fixed machinekey for your
ASP.NET application to see whether it helps:

#Getting CryptographicEx ception exception "Padding is invalid and cannot be
removed" after Migrating to ASP.NET 2.0
http://blogs.msdn.com/paraga/rss_tag_ASP.NET+2.0.xml

#ASP.Net¡¯s WebResource.axd and machineKey badness
http://blog.aproductofsociety.org/?p=11

The machinekey has many other impacts on ASP.NET services, here is a good
article mentioned them:

#How To: Configure MachineKey in ASP.NET 2.0
http://msdn2.microsoft.com/en-us/library/ms998288.aspx

Hope this also helps.

Sincerely,

Steven Cheng

Microsoft MSDN Online Support Lead

=============== =============== =============== =====

Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscripti...ult.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at
http://msdn.microsoft.com/subscripti...t/default.aspx.

=============== =============== =============== =====
This posting is provided "AS IS" with no warranties, and confers no rights.


--------------------

>Reply-To: "AG" <NO**********@n ewsgroups.nospa m>
From: "AG" <NO**********@n ewsgroups.nospa m>
References: <eK************ **@TK2MSFTNGP05 .phx.gbl>

<79************ *************** *******@microso ft.com>

>Subject: Re: Exception - Padding is Invalid
Date: Wed, 9 Jan 2008 21:05:12 -0500

Thanks Bruce,

Since I can't run any network traces, it sounds like I have to just ignore
it, unless it becomes more frequent.

--

AG
Email: discussATadhdat aDOTcom

"bruce barker" <br*********@di scussions.micro soft.comwrote in message
news:79******* *************** ************@mi crosoft.com...

>>a webresource request has encrypted parameters (assembly name, and

resource

>id) so a user canot just randomly pluck out resources values (such as a
connect string). after encryption, the parameters are convereted to

base64

>to
make the strings url safe. due to base64's algrothrym a the string

length

>is
always a mutilpe of three. to get this padding is added.

the error message means the parameter string was truncated (or has

illegal

>charaters) and does not match the url rendered. this is usally caused by

a

>proxy server that truncates the url because it too long, or performs some
other translation.

you would to run network traces to see if your end or the other end is
causing the problem.

-- bruce (sqlwork.com)
"

[AG]

Thanks Steven, I will try that.

--

AG
Email: discussATadhdat aDOTcom
"Steven Cheng[MSFT]" <st*****@online .microsoft.comw rote in message
news:KD******** *****@TK2MSFTNG HUB02.phx.gbl.. .

Hi AG,

As for the WebResource.axd , it use machinekey to encrypt the
assembly/resource item parameters. by default, the machinekey of a .NET
application is randomly generated. Thus, if you're using webfarm or your
application will frequently restart due to some reason, you'll likely to
get such invalid exception when a former generated encryption parameter is
passed to webresource.axd .

One thing you can try is manually supply a fixed machinekey for your
ASP.NET application to see whether it helps:

#Getting CryptographicEx ception exception "Padding is invalid and cannot
be
removed" after Migrating to ASP.NET 2.0
http://blogs.msdn.com/paraga/rss_tag_ASP.NET+2.0.xml

#ASP.Net¡¯s WebResource.axd and machineKey badness
http://blog.aproductofsociety.org/?p=11

The machinekey has many other impacts on ASP.NET services, here is a good
article mentioned them:

#How To: Configure MachineKey in ASP.NET 2.0
http://msdn2.microsoft.com/en-us/library/ms998288.aspx

Hope this also helps.

Sincerely,

Steven Cheng

Microsoft MSDN Online Support Lead

=============== =============== =============== =====

Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscripti...ult.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at
http://msdn.microsoft.com/subscripti...t/default.aspx.

=============== =============== =============== =====
This posting is provided "AS IS" with no warranties, and confers no
rights.


--------------------

>>Reply-To: "AG" <NO**********@n ewsgroups.nospa m>
From: "AG" <NO**********@n ewsgroups.nospa m>
References: <eK************ **@TK2MSFTNGP05 .phx.gbl>

<79************ *************** *******@microso ft.com>

>>Subject: Re: Exception - Padding is Invalid
Date: Wed, 9 Jan 2008 21:05:12 -0500

Thanks Bruce,

Since I can't run any network traces, it sounds like I have to just ignore
it, unless it becomes more frequent.

--

AG
Email: discussATadhdat aDOTcom

"bruce barker" <br*********@di scussions.micro soft.comwrote in message
news:79****** *************** *************@m icrosoft.com...

>>>a webresource request has encrypted parameters (assembly name, and

resource

>>id) so a user canot just randomly pluck out resources values (such as a
connect string). after encryption, the parameters are convereted to

base64

>>to
make the strings url safe. due to base64's algrothrym a the string

length

>>is
always a mutilpe of three. to get this padding is added.

the error message means the parameter string was truncated (or has

illegal

>>charaters) and does not match the url rendered. this is usally caused by

a

>>proxy server that truncates the url because it too long, or performs
some
other translation.

you would to run network traces to see if your end or the other end is
causing the problem.

-- bruce (sqlwork.com)
"

[Steven Cheng[MSFT]]

Thanks for your reply,

If you got any new results, welcome to post here.

Sincerely,

Steven Cheng

Microsoft MSDN Online Support Lead
This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------

>Reply-To: "AG" <NO**********@n ewsgroups.nospa m>
From: "AG" <NO**********@n ewsgroups.nospa m>
Subject: Re: Exception - Padding is Invalid
Date: Thu, 10 Jan 2008 07:54:29 -0500
Thanks Steven, I will try that.
AG
Email: discussATadhdat aDOTcom
"Steven Cheng[MSFT]" <st*****@online .microsoft.comw rote in message
news:KD******* ******@TK2MSFTN GHUB02.phx.gbl. ..

>Hi AG,

As for the WebResource.axd , it use machinekey to encrypt the
assembly/resource item parameters. by default, the machinekey of a .NET
application is randomly generated. Thus, if you're using webfarm or your
application will frequently restart due to some reason, you'll likely to
get such invalid exception when a former generated encryption parameter

is

>passed to webresource.axd .

One thing you can try is manually supply a fixed machinekey for your
ASP.NET application to see whether it helps:

#Getting CryptographicEx ception exception "Padding is invalid and cannot
be
removed" after Migrating to ASP.NET 2.0
http://blogs.msdn.com/paraga/rss_tag_ASP.NET+2.0.xml

#ASP.Net¡¯s WebResource.axd and machineKey badness
http://blog.aproductofsociety.org/?p=11

The machinekey has many other impacts on ASP.NET services, here is a good
article mentioned them:

#How To: Configure MachineKey in ASP.NET 2.0
http://msdn2.microsoft.com/en-us/library/ms998288.aspx

Hope this also helps.

Sincerely,

Steven Cheng

Microsoft MSDN Online Support Lead

============== =============== =============== ======

Get notification to my posts through email? Please refer to

http://msdn.microsoft.com/subscripti...ult.aspx#notif

>ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent

issues

>where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each

follow

>up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at
http://msdn.microsoft.com/subscripti...t/default.aspx.

============== =============== =============== ======
This posting is provided "AS IS" with no warranties, and confers no
rights.

[=?Utf-8?B?TWF0dGhldw==?=]

The problem does occur rather frequently - over a hundred times overnight on
one occasion. I'm not able to reproduce it consistently, and have seen only a
handful of errors in 24 hours on most occasions.

[Steven Cheng]

Can you determine where did those problem request come from? Is your
appliation an internet application or intranet one?

Best regards,

Steven Cheng
Microsoft MSDN Online Support Lead

Delighting our customers is our #1 priority. We welcome your comments and
suggestions about how we can improve the support we provide to you. Please
feel free to let my manager know what you think of the level of service
provided. You can send feedback directly to my manager at:
ms****@microsof t.com.

This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------

>Thread-Topic: Exception - Padding is Invalid
thread-index: AciKLmKHo8lmnQm MQgi5jOiciJcoXg ==
Subject: Re: Exception - Padding is Invalid
Date: Wed, 19 Mar 2008 19:02:00 -0700

>
The problem does occur rather frequently - over a hundred times overnight

on

>one occasion. I'm not able to reproduce it consistently, and have seen

only a

>handful of errors in 24 hours on most occasions.

[=?Utf-8?B?TWF0dGhldw==?=]

A sampling indicates the requests come from googlebot. The site is hosted at
www.dometech.com

[Steven Cheng]

Thanks for your reply mudnug,

If googlebot is the source agent, I think you've run into a common problem.
The google cache may contains a cached version of entire page(include the
viewstate hidden field). Thus, it will always send the cached
viewstate(that is specific to the certain machinekey which is used to sign
it). Then, when the application's server-side machinekey has changed, the
request based on the cached page will fail(with the invalid exception you
saw). Here is a web article also mentioned this:

#A Product of Society
http://blog.aproductofsociety.org/?p=11

If most of the errors in your site is caused by this, I think you can
simply ignore it.

Best regards,

Steven Cheng
Microsoft MSDN Online Support Lead

Delighting our customers is our #1 priority. We welcome your comments and
suggestions about how we can improve the support we provide to you. Please
feel free to let my manager know what you think of the level of service
provided. You can send feedback directly to my manager at:
ms****@microsof t.com.

This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------

>From: =?Utf-8?B?TWF0dGhldw= =?= <mu****@communi ty.nospam>
References: <eK************ **@TK2MSFTNGP05 .phx.gbl>

<79************ *************** *******@microso ft.com>
<Os************ **@TK2MSFTNGP02 .phx.gbl>
<KD************ *@TK2MSFTNGHUB0 2.phx.gbl>
<93************ *************** *******@microso ft.com>
<iI************ **@TK2MSFTNGHUB 02.phx.gbl>
<E8************ *************** *******@microso ft.com>
<fQ************ **@TK2MSFTNGHUB 02.phx.gbl>

>Subject: Re: Exception - Padding is Invalid
Date: Thu, 20 Mar 2008 15:55:01 -0700

>
A sampling indicates the requests come from googlebot. The site is hosted

at

>www.dometech.com