Padding is invalid and cannot be removed

[debjyoti7]

We developed ASP.Net application where we are using Crystal Report 2020 as reporting tool.

We deployed the application and installed CR Run Time (13.0.32.4286) in production server (Windows 2012 R2 with IIS 8).

When we preview the report and keep it open longer than 5 minutes then perform pagination we get an error

“Padding is invalid and cannot be removed.“

Attached below the Stack Trace:

<!--

Inner Stack Trace:

Stack Trace:

at System.Security.Cryptography.CapiSymmetricAlgorithm.DepadBlock(Byte[] block, Int32 offset, Int32 count)

at System.Security.Cryptography.CapiSymmetricAlgorithm.TransformFinalBlock(Byte[] inputBuffer, Int32 inputOffset, Int32 inputCount)

at System.Security.Cryptography.CryptoStream.FlushFinalBlock()

at System.Security.Cryptography.CryptoStream.Dispose(Boolean disposing)

at System.IO.Stream.Close()

at System.IO.StreamReader.Dispose(Boolean disposing)

at System.IO.TextReader.Dispose()

at CrystalDecisions.Shared.EncryptionManager3.DecryptStringFromByte(Byte[] cipherText)

at CrystalDecisions.Web.ViewerGlobal.DeserializeBase64StringIntoObject(String base64String)

at CrystalDecisions.Web.CrystalReportViewerBase.LoadViewState(Object viewState)

-->

Please suggest how to go about it.

[former_member11696 · Accepted solution]

R&D says what you are doing is fine, we don't create the keys until the fist use. Once connected all communication is encrypted using the keys we create or the one you are creating.

OK, so you either have to pop a message after the timeout to refresh the report using a viewer event to get a new session and re-open the report or tell the user to start over.

Don't set the session to terminate after 5 minutes, set it the same as IIS timeout then they have 20 minutes to refresh the report.

Not sure what you are expecting, it looks as though it's working as configured.

[debjyoti7]

Don

Thanks for the assistance. We really appreciated your help. In case we need further help in future I will reach out to you again.

Regards

Fi-Tek Team.

[debjyoti7]

Yes, when we hit next page within 5 minutes page 2 is coming.

For testing purpose we set the worker process timeout to 5 minutes but in production our time out is set to 20 minutes.

We are keeping the session live using PostBack method.

When our user is idle keeping the report open for more than the specified worker process timeout period they are facing this issue.

Thanks

[former_member11696]

So what Dev says is we now randomly create those keys due to a CVE issue found.

What you are doing has AES encryption so it should be secure.

The problem we see is 5 minutes seems awfully short and likely the cause of the session going out of scope.

So you still need to use PostBack method to keep the Session active and in scope...

When the user clicks on next page if the session is closed and PostBAck is not used there is nothing for the report to refresh, this is why you need to use those methods.

If they hit next page within 5 minutes do they get page 2?

[former_member11696]

Hello,

Interesting way to keep the report valid you found/use.

I've never tried it or ask R&D if it's supported or not.

For all CR and BOE .NET SDK solutions is to use sessions and PostBack to keep the report valid and in scope.

Which is why we don't create the key pair, this is customization you are doing, not typical for CR runtime. It may be a better way but until Dev says so we can't support it, there may be security issues doing it that way but just a s guess from me.

I'll check with Dev and see if they have any concerns with your solution.

Don

[former_member11696]

Hello,

I changed your Tag to CR for VS.

The issue is you need to use PostBack method to keep the report in scope.

protected void Page_Init(object sender, EventArgs e)
{
        //btnListReports_Click(sender, e);
    if (IsPostBack) // post back event, check if report is in session if it is view it.
    {
        rptClientDocMgd = (CrystalDecisions.ReportAppServer.ClientDoc.ReportClientDocument)Session["sesrptRCD"];
    }
}

You can search also for more details specific to your project and how you deal with it.

the important part is using PostBack to keep the report in session.

Have a great day

Don

[debjyoti7]

Thank you for your feedback.

We have IIS Application Pool configurations as:

1. IIS Worker Process idle Time-out is set to “5” minutes and Idle Time-out Action is set to “Terminate”

2. Maximum Worker Process is set to 20

Now after 5 minutes when the IIS worker process gets terminated/recycled and user tries to navigate to next/previous page Crystal Report Viewer generates error

“Padding is invalid and cannot be removed.“

We resolved the above mentioned error by doing the following:

1. Introduced a registry key,”KeyPair” in the path “HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\SAP BusinessObjects\Crystal Reports for .NET Framework 4.0\Crystal Reports”

2. Created two String Value IV and KEY under the above mentioned key.

We generated protected machine dependent AES KEY/IV using “AesCryptoServiceProvider” and further converting into Base64 string for the above string values.

We expected that this “KeyPair” should have been created during the time of Crystal Report 2020 runtime installation.

But this did not happen.

Please let us know if this is the right process or you can suggest any other best possible way.

W.r.t your previous solution we would like to inform you that we are not keeping the report object in the session as it increases the webserver load and moreover this error happens when the Crustal Report is trying to decrypt the viewer ViewState with a different auto generated key after the worker process is recycled.

Thanks