KB2418241, KB2416473, and KB2416451 all reference http://www.microsoft.com/technet/security/bulletin/MS10-070.mspx
After installing this patches on our Windows Server 2003 machines last Friday, we have been getting a significantly increased rate of errors of the sort:
System.Web.Mvc.HttpAntiForgeryException: A required anti-forgery token was not supplied or was invalid. ---> System.Web.HttpException: Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that <machineKey> configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster. ---> System.Web.UI.ViewStateException: Invalid viewstate.
The setup is as follows:
- The web applications are running in a web cluster, with the NLB settings to Client Affinity: Single.
- There are redirects between two separate web applications, and both of their machineKey elements are identical using explicit validationKey and decryptionKey elements.
The validation method is set to "SHA1" and the decryption method is set to "AES"
(Furthermore, no redeployments of the applications have taken since well before the microsoft updates were installed).
These errors could of course be caused by actual CSRF attacks, but I find it unlikely given the volume and the spike corresponding with installation of the updates.
Are there any known issues with this update that could be causing this? (and even better, any known workarounds?)