From 6fa7d3b29cde56b404ba082c3ae209e15c10e058 Mon Sep 17 00:00:00 2001
From: Jonas Vestberg <bugch3ck@users.noreply.github.com>
Date: Sat, 4 Dec 2021 00:13:15 +0000
Subject: [PATCH] Remove default machineKey

Remove default machineKey as it is a serious security issue. The default behavior is to let the framework generate a new machineKey on each restart. This will work in most cases. In other edge cases, such as a non-sticky load balancer setup, a machineKey may be used (but not the default one).
---
 BlogEngine/BlogEngine.NET/Web.Config | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/BlogEngine/BlogEngine.NET/Web.Config b/BlogEngine/BlogEngine.NET/Web.Config
index e698ac4f5..c3d5300ee 100644
--- a/BlogEngine/BlogEngine.NET/Web.Config
+++ b/BlogEngine/BlogEngine.NET/Web.Config
@@ -89,7 +89,6 @@
     <globalization requestEncoding="utf-8" responseEncoding="utf-8" culture="auto" uiCulture="auto" />
     <httpRuntime targetFramework="4.5" enableVersionHeader="false" useFullyQualifiedRedirectUrl="true" maxRequestLength="16384" executionTimeout="3600" requestLengthDiskThreshold="16384" requestValidationMode="2.0" requestPathInvalidCharacters="&lt;,&gt;,*,\" />
 
-    <machineKey validationKey="D9F7287EFDE8DF4CAFF79011D5308643D8F62AE10CDF30DAB640B7399BF6C57B0269D60A23FBCCC736FC2487ED695512BA95044DE4C58DC02C2BA0C4A266454C" decryptionKey="BDAAF7E00B69BA47B37EEAC328929A06A6647D4C89FED3A7D5C52B12B23680F4" validation="SHA1" decryption="AES" />
     <!--<machineKey validationKey="AutoGenerate,IsolateApps" decryptionKey="AutoGenerate,IsolateApps" validation="SHA1" decryption="AES"/>-->
 
     <authentication mode="Forms">
@@ -267,4 +266,4 @@
       </dependentAssembly>
     </assemblyBinding>
   </runtime>
-</configuration>
\ No newline at end of file
+</configuration>