BlogEngine.NET
BlogEngine.NET copied to clipboard
Remove default machineKey
Remove default machineKey as it is a serious security issue. The default behavior is to let the framework generate a new machineKey on each restart. This will work in most cases. In other edge cases, such as a non-sticky load balancer setup, a machineKey may be used (but not the default one).
This is a good idea. Another option, as good and maybe even better, would be to uncomment the commented-out machineKey setting (Autogenerate,IsolateApps).