Cross-Origin Causes formsauthentication. decrypt to report the error: the filling is invalid and cannot be removed.

Recently, because form verification is required, because it is tested on the local machine, the domain of the cookie generated after Form Verification is written under the localhost name. However

However, I tried to use http: // 192.168.1.33/decrpt. aspx (my local IP address), when the page decrypts the encrypted formauthenctionticket, the error "filling is invalid and cannot be removed" is reported. After multiple tests, it is found that if http: // localhost/decrpt. aspx is used for decoding, it will work normally together. It seems that the encrypted ticket is verified using form, and the domain must be consistent during decryption.

Encryption code:

 

Code

Formsauthentication. setauthcookie (strusername, true); // form verification, set cookie
Datetime strdatetimenow = datetime. now;
String strguid = system. guid. newguid (). tostring ();
String strssid = session. sessionid;
String IP = request. servervariables ["http_x_forwarded_for"];
If (string. isnullorempty (IP ))
{
// Directly connect to the Client IP address without a proxy IP Address
IP = request. servervariables ["remote_addr"]; // If a proxy is used, the IP address of the proxy server is obtained. If you use multiple proxy servers, It is the IP address of the last proxy server that reaches the server.
}
Try
{
Intauthid = LG. insertauth (strusername, strguid, strssid, IP, strdatetimenow );
}
Catch
{}
Formsauthenticationticket ticket = new formsauthenticationticket (1, formsauthentication. formscookiename, datetime. now, datetime. now. addminutes (20), false, strusername + "|" + strguid + "|" + strssid + "|" + IP + "|" + strdatetimenow); // create a ticket
String encticket = formsauthentication. Encrypt (ticket); // create a string to encrypt the ticket
Httpcookie ck = new httpcookie (formsauthentication. formscookiename, encticket); // create a new cookie named after the cookie in the ticket
System. Text. Encoding EC = system. Text. encoding. getencoding ("UTF-8 ");
Byte [] bt = EC. getbytes (intauthid. tostring ());
Httpcookie ckauthid = new httpcookie ("ax", convert. tobase64string (BT ));
// Ckauthid. expires = datetime. Now
If (CK! = NULL & ckauthid! = NULL)
{
Ckauthid. expires = ck. expires = datetime. Now. adddays (15); // cookie is saved for 2 weeks
Context. response. Cookies. Add (CK); // output cookie
Context. response. Cookies. Add (ckauthid );
}

 

Decryption code:

 

Code

Formsauthenticationticket ticke = NULL;
String [] Parr = request. querystring ["p"]. Split (New char [] {'| '});
Try
{
Ticke = formsauthentication. decrypt (Parr [0]);
}
Catch
{
// Decryption error
Toxml ("<F> <status> 4 </status> <URL> http: // 192.168.1.3/login. aspx </URL> </F> ");
}
Private void toxml (string strcontent)
{
Response. charset = "UTF-8 ";
Response. contentencoding = system. Text. encoding. utf8;
Response. contenttype = "text/XML ";
Response. Clear ();
Response. Write ("<? XML version = \ "1.0 \" encoding = \ "UTF-8 \"?> \ N "+ strcontent );
Response. End ();
}