Server is Able to Decrypt Forms Authentication Key Generated on my Local System

Question

I am in .NET 4.0 paradigm and I noticed a scenario. My API was using FormsAuthentication.Encrypt method to create a token for the user. the problem is that if I run the API on localhost, call the api to get the key, I can use the same key on subsequent request to the server. Why is this happening? Is this desired behavior? Isn't it a security risk?

Answer 1

The problem was that we were overriding the machineKey value in our applications web.config. So both applications (running on local machine and server) were using same keys to encrypt and decrypt. Hence, it was possible for server to decrypt key encrypted by local machine and vice versa.