Session issue after deployment

Hi,

I recently created a client eCommerce solution using the nopCommerce framework as a base, which I'm very impressed with, btw.  This was my first eCommerce solution, so bear with my noobishness.  I normally write desktop/embedded/mobile apps, so I'm not an expert on web apps (though trying to get there).

We set up a development site on our local servers, and then once we had a releasable product, we pushed it out to the client's host plan.

Everything went smooth, except for one issue: any user that logs in, gets randomly logged out after a few minutes.  And it seems to be system-wide... if multiple users are logged in, they all seem to get logged out at the same time.  I *could* be wrong about that, but from casual observation, seems to be the case.  It's not easy to get 3-4 people to get away from their work to help me debug this here at the office place, lol.

This issue does not occur for the development site on our local servers.  I'm not sure where to look first to resolve this, whether it's an IIS issue, or a .config setting that's incorrect, or a cookie thing...

Looking through the web.config file, there were a few interesting properties that I thought could be related, but I didn't want to touch it.  I've left the file mostly unchanged except for changing the connection string.

The <NopConfig>
    <Cache Enabled="True"/>
    <ScheduleTasks>

section seemed to have a few interesting properties, with caches and keepalives and expiredsessions, but I haven't modified them as of yet.

I left sessionstate unchanged, too: <sessionState timeout="1440" mode="InProc" cookieless="false"/>

Would anyone be able to shed light on this?  I'm not super well-versed on the server aspect of websites, so this is a learning process.  I did some searches, but was unable to find anything related.

Thanks in advance.

Oh, and occasionally when I log in, I get this error.  And my site is not running on a web farm:




Server Error in '/' Application.
________________________________________
Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that <machineKey> configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.Web.HttpException: Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that <machineKey> configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.

Source Error:

[No relevant source lines]

Source File: c:\windows\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files\root\e15f5332\1416945f\App_Web_fdgobx_y.8.cs    Line: 0

Stack Trace:

[HttpException (0x80004005): Unable to validate data.]
   System.Web.Configuration.MachineKeySection.GetDecodedData(Byte[] buf, Byte[] modifier, Int32 start, Int32 length, Int32& dataLength) +289
   System.Web.UI.ObjectStateFormatter.Deserialize(String inputString) +140

[ViewStateException: Invalid viewstate.
         Client IP: 173.15.45.30
         Port: 33183
         User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.2; OfficeLiveConnector.1.3; OfficeLivePatch.0.0; .NET4.0C)
         ViewState: /wEPDwUJNTIyOTQwNjUwD2QWAmYPZBYCZg9kFgQCAQ9kFgQCAQ8WAh4HY29udGVudAUbWW91ciBzdG9yZSBtZXRhIGRlc2NyaXB0aW9uZAICDxYCHwAFJ3Nwb3J0aW5nIGdvb2RzIGNvbHVtYnVzIGluZGlhbmEgYXBwYXJlbGQCAw9kFgQCAQ9kFghmD2QWAgIBDw9kFgQeB29uZm9jdXMFK2lmKHRoaXMudmFsdWU9PSdTZWFyY2ggc3RvcmUnKXRoaXMudmFsdWU9JyceCW9ua2V5ZG93bgXKAWlmKGV2ZW50LndoaWNoIHx8IGV2ZW50LmtleUNvZGUpe2lmICgoZXZlbnQud2hpY2ggPT0gMTMpIHx8IChldmVudC5rZXlDb2RlID09IDEzKSkge2RvY3VtZW50LmdldEVsZW1lbnRCeUlkKCdjdGwwMF9jdGwwMF9jdHJsSGVhZGVyX2N0cmxTZWFyY2hCb3hfYnRuU2VhcmNoJykuY2xpY2soKTtyZXR1cm4gZmFsc2U7fX0gZWxzZSB7cmV0dXJuIHRydWV9OyBkAgIPDxYCHgdWaXNpYmxlaGQWAmYPEGRkFgBkAgMPDxYCHwNoZBYCZg8QZGQWAGQCBA8PFgIfA2hkFgJmDxBkZBYAZAIFD2QWBAIBD2QWCgIBDw8WAh8DaGRkAgMPZBYGAgMPFgIeBFRleHQFKFlvdSBoYXZlIG5vIGl0ZW1zIGluIH...]

[HttpException (0x80004005): Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that <machineKey> configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.]
   System.Web.UI.ViewStateException.ThrowError(Exception inner, String persistedState, String errorPageMessage, Boolean macValidationError) +106
   System.Web.UI.ViewStateException.ThrowMacValidationError(Exception inner, String persistedState) +14
   System.Web.UI.ObjectStateFormatter.Deserialize(String inputString) +242
   System.Web.UI.ObjectStateFormatter.System.Web.UI.IStateFormatter.Deserialize(String serializedState) +4
   System.Web.UI.Util.DeserializeWithAssert(IStateFormatter formatter, String serializedState) +37
   System.Web.UI.HiddenFieldPageStatePersister.Load() +207
   System.Web.UI.Page.LoadPageStateFromPersistenceMedium() +105
   System.Web.UI.Page.LoadAllState() +43
   System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +6785
   System.Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +242
   System.Web.UI.Page.ProcessRequest() +80
   System.Web.UI.Page.ProcessRequestWithNoAssert(HttpContext context) +21
   System.Web.UI.Page.ProcessRequest(HttpContext context) +49
   ASP.login_aspx.ProcessRequest(HttpContext context) in c:\windows\Microsoft.NET\Framework\v2.0.50727\Temporary ASP.NET Files\root\e15f5332\1416945f\App_Web_fdgobx_y.8.cs:0
   System.Web.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +181
   System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +75

________________________________________
Version Information: Microsoft .NET Framework Version:2.0.50727.3603; ASP.NET Version:2.0.50727.3082

I had the same problem and know just enough to probably be dangerous.  Your 'machine key' keeps changing, probably because your are on a shared server.  Every time the 'machine key' changes, a new log in is required.  You can use ISS to set a static (non-changing) 'machine key' in  your web.config file.  Start ISS, connect to your nopcommerce site, click on the Machine Key icon, and go from there.

We may have a winner, thanks for your advice.  I was unable to connect via IIS like you had said, but I found a site that generates machine codes, plugged that into the web.config, and so far so good.  Will post if that changes.

I'm experiencing constant logouts in the administration panel with my site uploaded to a host. It's on a shared server.

I'm probably missing something but what exactly do I need to do to sort out the issue? Is it something I need to "fix" in the web.config file? My host doesn't give me access to IIS on the server beyond choosing which version of the framework to run.

Thanks in advance!

SylverFyre wrote:
You should generate and add your own machineKey to web.config file
http://www.codeproject.com/KB/aspnet/Machine_Key_Generator.aspx

Sorted, thanks Andrei

Took a little trial and error on where to paste the machinekey into web.config, but all running a treat now.

For anyone else trying to fix this problem, I pasted after the </pages> element and before the <httpHandlers> element and it works :)

Thanks for this.  Just sorted my very annoying problem out!  

//A

Seems we have the same issue on our site.  It just started, wasn't an issue to start with.  Anyway neither of us know how to make the change suggested here so wondered if someone could help us.  We are willing to pay for the help.

NOPCommerse is brillient at what it does but I just don't understand how it works and that is making things ackward, thinking about going back to joomla.


Dan

This happens when your webhost is hosting various sites across various machines to spread and balance the load across it's servers.

You need to give your application a machineKey so that it keeps the session information live for your login even if a different machine takes over halfway through your session.

To do this you follow the link in Andrei's (a.m.) post to generate a unique machine key which you then edit into your sites web.config file. My earlier post gives you a location where entering the machineKey element works.

If you need more specific instructions then post again and I'll break it down into step-by-step instructions.