ASP.NET Core MVC Interview Question #198

How would you manage Data Protection keys in a load-balanced MVC application?

Senior Practical MVC Scenarios & Production Architecture Senior Advanced

Quick Interview Answer

Instances that need to read the same protected cookies or other Data Protection payloads must share a compatible key ring. Persist keys to a suitable shared location and protect the key material according to the hosting environment.

Detailed Explanation

If each instance uses unrelated ephemeral keys, authentication cookies and other protected values may fail when requests move between servers or after an instance restarts.

Code Example

builder.Services.AddDataProtection()
    .SetApplicationName("MyMvcApp")
    .PersistKeysToFileSystem(
        new DirectoryInfo(sharedKeyPath));