Forms authentication failed for the request, the ticket supplied was invalid.

[Sacchidananda]

Hello

I'm running an ASP.NET 2.0 application on IIS 6 and Windows Server 2003. I'm not using a web farm or garden.I've been getting these errors for a very long time, with some users having to log in each time they visit the site.I've been getting tons of Information events in my Application Event Log with the following message:

Event code: 4005 ,message: Forms authentication failed for the request. Reason: The ticket supplied was invalid.
Not all users have this issues,it happens across a variety of browsers My users the ones that keep getting logged out are noticeably upset and I'm probably losing traffic over the issue.this is the excerpt from my web.config:

<machineKey validationKey="1E4C8BDB22BAA19BA52EE9097121B730A075C98E80CC0578DAB61BCDE8ABA6C54901173EC0410BA46884C B7FD116C4DEE88B559FEB90E825175096C7BCEB5106"
decryptionKey="1CFB46205EE8CAB4A13CD463600D38686F665D7365362442" validation="SHA1" />
<authentication mode="Forms">
<forms loginUrl="login.aspx" protection="All" timeout="5000000" defaultUrl="home.aspx"/>
</authentication>

i want to know your opinion about this..
thanks for any reply

[johnson22]

I know this kind or issues arises because of multiple reasons , the most likely is someone trying to login to the forums with an old or expired authentication ticket requiring them to log in, it could genuinely be someone attempting to exploit the forum and create an authentication ticket that will gain them access, this is likely to fail in all cases, generally I would not worry about it unless you're seeing hundreds or thousands every day

[Techguru01]

There are several circumstances that may cause this issue. Each known condition is presented with a short explanation and a possible workaround.IIS 6 will eventually recycle the program pool to keep the health of the application pool. At the instance when the application pool is being recycled, browser requests which can results in an invalid view state error. The cure in this case is to adjust the settings on the application pools so that recycling is less likely to occur at peak periods. This issue denotes a bug since the application pool is supposed to gracefully handle this condition.

[deveritt]

Since the View State is saved in a hidden field on a Web page, it is more likely to tamper when data is being transferred between the client and the server.So in order to make View State more secure, ASP.NET validates View State to confirm that it came from the correct page. I think from the error message, it's obviously caused by the expired time of the ticket. From the code we can see that you set the cookie as long as possible, but if the expired time of the ticket is short, the ticket is invalid in a short time. You can check that.If ASP.NET cannot validate View State, ASP.NET returns a message to the client browser that states that "viewstate is invalid for this page and might be corrupted." However, the message does not describe why View State is not valid.