Our site is hosted on a shared server and we see frequent errors related to expired sessions, as well as frequent errors ('padding is invalid and cannot be removed') from bot visits to expired pages.


Doing research, I've found a couple tips, but wanted to get feedback on possible implications before implementing.



The first is adding a machinekey tag to web.config with hardcoded keys to help resolve some of the session errors. The second is dissalowing bots from, .axd pages. I know these are trying to resolve two seperate issues, but i'm just trying to address all changes in one post. Thanks for any feedback.

Thanks Marcus, That is exactly the code I was planning to use! much appreciated.