Jun 13

Written by: Daniel Balla
Mon, 13 Jun 2011 19:25:04 GMT

I didn't blog for so long that I forgot my password :)
Anyway, back to the issue at hand, I've wasted so much time troubleshooting this environment that it is worth posting about it. This is the case of the ASP.NET application losing state in a web farm environment. The scenario is a straight-forward ASP.NET application deployed in a farm with a load balancer in front.
The problem was that the application was losing state in between requests. My findings are summarised in the check-list below.

•  Check the session state access. You are most likely using the SQL server session state so check the connection strings and ensure that the ports are open from each web node to the database.

•  Assuming that you are not using sticky sessions, and that you use Forms Authentication and/or have EnableViewStateMAC enabled (which you should) ensure that the configuration is consistent across all the nodes in the farm and that it defines both the decryption key and the validation key.

•  In IIS set the same Site Name and application id across all nodes. You can review these in IIS manager: select the web site and then click on advanced settings under Manage Web Site. It is important that they are equal as asp.net uses the id as part of the composite key to the application and session state in the state sql database.

•  Ensure that the nodes in the web farm have identical environments. This includes the operating system version, IIS version, windows updates and security updates. I know this sounds obvious but I was caught by a security update addressing an asp.net security vulnerability affecting the asp.net encryption (KB2416471) being installed only on one of the nodes. It so happens that Microsoft changed the way the asp.net encryption works and the application was not be able to decrypt the shared state.

The script below is a convenient way to check if an update is installed:

wmic qfe get hotfixid | find "2416471" 1>nul && echo Installed || echo Not installed

Please keep in mind that this list is not exhaustive.

Tags: