Getting Bad Request when trying to log in

[sadukie]

Saw this reported in devBetter Discord.

Confirmed with Azure logs from the App Service:

2026-07-19T17:07:32.6248652Z Microsoft.AspNetCore.Antiforgery.AntiforgeryValidationException: The antiforgery token could not be decrypted.
2026-07-19T17:07:32.6248686Z  ---> System.Security.Cryptography.CryptographicException: An error occurred during a cryptographic operation. Refer to the inner exception for more information.
2026-07-19T17:07:32.6248843Z  ---> System.MissingMethodException: Method not found: 'Boolean Microsoft.AspNetCore.Cryptography.CryptoUtil.TimeConstantBuffersAreEqual(Byte[], Int32, Int32, Byte[], Int32, Int32)'.
2026-07-19T17:07:32.6248878Z    at Microsoft.AspNetCore.DataProtection.Managed.ManagedAuthenticatedEncryptor.Decrypt(ArraySegment`1 protectedPayload, ArraySegment`1 additionalAuthenticatedData)
2026-07-19T17:07:32.6248901Z    --- End of inner exception stack trace ---
2026-07-19T17:07:32.6248929Z    at Microsoft.AspNetCore.DataProtection.Managed.ManagedAuthenticatedEncryptor.Decrypt(ArraySegment`1 protectedPayload, ArraySegment`1 additionalAuthenticatedData)
2026-07-19T17:07:32.6248957Z    at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector.UnprotectCore(Byte[] protectedData, Boolean allowOperationsOnRevokedKeys, UnprotectStatus& status)
2026-07-19T17:07:32.6248983Z    at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector.Unprotect(Byte[] protectedData)
2026-07-19T17:07:32.6249007Z    at Microsoft.AspNetCore.Antiforgery.DefaultAntiforgeryTokenSerializer.Deserialize(String serializedToken)
2026-07-19T17:07:32.624903Z    --- End of inner exception stack trace ---
2026-07-19T17:07:32.6249055Z    at Microsoft.AspNetCore.Antiforgery.DefaultAntiforgeryTokenSerializer.Deserialize(String serializedToken)
2026-07-19T17:07:32.6249085Z    at Microsoft.AspNetCore.Antiforgery.DefaultAntiforgery.DeserializeTokens(HttpContext httpContext, AntiforgeryTokenSet antiforgeryTokenSet, AntiforgeryToken& cookieToken, AntiforgeryToken& requestToken)
2026-07-19T17:07:32.6249173Z    at Microsoft.AspNetCore.Antiforgery.DefaultAntiforgery.ValidateTokens(HttpContext httpContext, AntiforgeryTokenSet antiforgeryTokenSet)
2026-07-19T17:07:32.6249201Z    at Microsoft.AspNetCore.Antiforgery.DefaultAntiforgery.ValidateRequestAsync(HttpContext httpContext)
2026-07-19T17:07:32.6249228Z    at Microsoft.AspNetCore.Mvc.ViewFeatures.Filters.ValidateAntiforgeryTokenAuthorizationFilter.OnAuthorizationAsync(AuthorizationFilterContext context)
2026-07-19T17:07:32.6251364Z [17:07:32 INF] Authorization failed for the request at filter 'Microsoft.AspNetCore.Mvc.ViewFeatures.Filters.AutoValidateAntiforgeryTokenAuthorizationFilter'.
2026-07-19T17:07:32.6251428Z [17:07:32 INF] Executing StatusCodeResult, setting HTTP status code 400

[sadukie]

Root cause: half-finished .NET 10 upgrade. Commit 1e27219 ("Upgrade project to .NET 10.0") bumped the Docker images but nothing else:

• Dockerfile / src/DevBetterWeb.Web/Dockerfile → now mcr.microsoft.com/dotnet/aspnet:10.0 / sdk:10.0
• But every .csproj still targets net9.0 (Web, Core, Infrastructure, both test projects)
• global.json still pins SDK 8.*
• Directory.Packages.props has a mixed bag of framework versions: Microsoft.AspNetCore.Identity.EntityFrameworkCore, Identity.UI, Diagnostics.EntityFrameworkCore, Mvc.Razor.RuntimeCompilation, Mvc.Testing, EF Core InMemory/Sqlite/SqlServer are all pinned at 9.0.15, while Microsoft.Extensions.Identity.Core/Stores, EntityFrameworkCore.Tools, Extensions.DependencyInjection, Extensions.Logging.AzureAppServices, Serilog.AspNetCore are pinned at 10.x.

So in production, a net9.0-targeted app is running inside a container that only has the .NET 10 shared runtime installed. The app rolls forward to .NET 10's Microsoft.AspNetCore.DataProtection/Antiforgery/Cryptography.Internal assemblies, but those aren't ABI-compatible with net9 the way in-major patch versions are — internal methods like CryptoUtil.TimeConstantBuffersAreEqual can change or move between majors. That's exactly the MissingMethodException you're seeing, wrapped by antiforgery as a decrypt failure. It'll hit every request that needs antiforgery validation (any POST with a form token) — matches "production error" scope.

Fix

Finish the upgrade consistently, don't patch around the symptom:

1. Bump TargetFramework to net10.0 in all 5 .csproj files
2. Bump global.json SDK to 10.*
3. Bump the 9.0.15-pinned packages in Directory.Packages.props to their 10.x equivalents so the whole Identity/EFCore/Mvc stack is on one major version
4. Rebuild, redeploy

Alternative (faster, if you're not ready for a full net10 upgrade tonight): revert both Dockerfiles back to aspnet:9.0/sdk:9.0 to match what the code actually targets. That gets prod stable immediately; do the real upgrade later.

[sadukie]

Also, the App Service is running on .NET 9. The stack will need to be updated to .NET 10 once the update gets pushed.

[sadukie]

Fixed in #1425