Machine Key: Key + IsolateApps is not working

Topics: Administration, General, Installing Orchard
Jun 8, 2014 at 6:45 PM
Hi,
I have clean installation of the Microsoft Windows Server 2012 R2 with IIS. Using Visual Studio I built the Orchard from its source code and I put 127.0.0.1 mydomain.com to the hosts so I am able to use the website. The website is working great except one thing.

According http://docs.orchardproject.net/Documentation/Setting-up-a-machine-key I setup Machine Key but it seems it is not working correctly or I did some mistake.

AutoGenerate,IsolateApps
[x] Automatically generate at runtime
[x] Generate a unique key for each application
Result: Working but the user is log off after a short time period of inactivity.

ABC1234BCA...(some key generated by IIS),IsolateApps
[ ] Automatically generate at runtime
[x] Generate a unique key for each application
Result: Not working. I can see only a white screen (website is not displayed).

ABC1234BCA...(some key generated by IIS)
[ ] Automatically generate at runtime
[ ] Generate a unique key for each application
Result: Working. The website is visible and the user is not logoff after some time of inactivity.
But is that secure? If I understand correctly the IsolateApps is required for the security. I would like to put the site to the public internet as soon as possible but I am worry if this configuration is secure.

Thank you.
Jul 14, 2014 at 6:07 PM
I am also experiencing this problem when running Orchard 1.8.1 on Windows 7 using IIS 7.5 (installed through Web Platform Installer as http://localhost/orchard).

If I use xxx,IsolateApps I get white screens when attempting to log in, where xx is a machine key generated with IIS.

Using just a bare machine key, I am able to log into the app but I get an exception when I attempt to publish content, which claims my machine key is bad ("The anti-forgery token could not be decrypted.").
Jul 15, 2014 at 10:30 AM
Hi corsairmarks,
I found on a another forum that you should not use xxx,IsolateApps. Use just xxx. It is a IIS bug that it is possible to set xxx and IsolateApps. Now I use only xxx and everything works great.