title: ASP.MVC antiforgery token and cryptographic errors
body: <p>I'm using ELMAH to handle errors in my MVC sites and I've noticed over the past couple of weeks that I'm getting some CryptographicExceptions thrown.  The message is:</p>
  <blockquote>
  <p>System.Security.Cryptography.CryptographicException: Padding is invalid and cannot be removed.</p>
  <p>System.Web.Mvc.HttpAntiForgeryException:
  A required anti-forgery token was not
  supplied or was invalid. ---&gt;
  System.Web.HttpException: Validation
  of viewstate MAC failed. If this
  application is hosted by a Web Farm or
  cluster, ensure that 
  configuration specifies the same
  validationKey and validation
  algorithm. AutoGenerate cannot be used
  in a cluster. ---&gt;</p>
  </blockquote>
  <p>The application is not running in a cluster and I can't seem to reproduce these errors.  They look like valid requests -- not a hand-crafted post -- and do contain the __RequestVerificationToken cookie.  I do have the required HTML helper on the page, inside the form (my login form).</p>
  <p>I haven't had any user complaints, yet, so I'm assuming that eventually it works for whoever is trying to login, but I'm left wondering why this could be happening.</p>
  <p>Anyone else seeing this behavior or have any ideas on how to diagnose the exception -- like I said, I can't get it to fail.  Deleting the cookie in FF comes up with a different error.  Modifying the cookie (changing or removing the contents) also results in a different error, as does modifying the contents of the hidden token input on the page.</p>