Chris Blankenship's Ramblings

I started thinking about how my web.config should be configured in regards to the machineKey values.  I did a little investigationand discovered that Microsoft has a specific recommendation for when you only have one web server.  Here the blurp from the article:

With the default values of Auto for the decryption attribute and AutoGenerate,IsolateApps for the decryptionKey, tickets are encrypted with AES symmetric encryption. As far as possible, ensure that both the validation and decryption keys are set to AutoGenerate instead of being hard-coded.

   1: <machineKey 

   2:   validationKey="AutoGenerate,IsolateApps" 

   3:   decryptionKey="AutoGenerate,IsolateApps" 

   4:   validation="SHA1" 

   5:   decryption="Auto" />