title: Generating new machinekey breaks login for existing users
body: <p>We have an application where we want to change the machine key. This key is used to encrypt session, cookies (among others) in ASP.NET.</p>
  
  <p>When changing the machine key, we expected ASP.NET to make all existing cookies invalid and show the login page when trying to reach a page protected by authentication. However, we end up with the following exception:</p>
  
  <p><code>[CryptographicException: Error occurred during a cryptographic operation.]
  System.Web.Security.Cryptography.HomogenizingCryptoServiceWrapper.HomogenizeErrors(Func`2 func, Byte[] input) +178
  System.IdentityModel.Tokens.SessionSecurityTokenHandler.ApplyTransforms(Byte[] cookie, Boolean outbound) +179
  System.IdentityModel.Tokens.SessionSecurityTokenHandler.ReadToken(XmlReader reader, SecurityTokenResolver tokenResolver) +827
  System.IdentityModel.Tokens.SessionSecurityTokenHandler.ReadToken(Byte[] token, SecurityTokenResolver tokenResolver) +87
  System.IdentityModel.Services.SessionAuthenticationModule.ReadSessionTokenFromCookie(Byte[] sessionCookie) +569
  System.IdentityModel.Services.SessionAuthenticationModule.TryReadSessionTokenFromCookie(SessionSecurityToken&amp; sessionToken) +306
  System.IdentityModel.Services.SessionAuthenticationModule.OnAuthenticateRequest(Object sender, EventArgs eventArgs) +159
  System.Web.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +229
  System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean&amp; completedSynchronously) +98</code></p>
  
  <p>(I apologize for the bad formatting here.)</p>
  
  <p>This means by changing the machine key breaks existing logged in users, which is not exactly what we want. We could also clear cookies older than <em>now</em>, but it sounds rather hacky to do.</p>
  
  <p>Is there any way to solve this without explicitly invalidate the user's cookie, like purposed in <a href="https://stackoverflow.com/questions/28857128/is-it-possible-to-tell-iis-to-treat-all-old-cookies-as-expired-cryptographicex">this post</a> or in <a href="https://stackoverflow.com/questions/14119965/federated-authentication-on-azure">this post</a>?</p>