Home/ Questions/Q 139635
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-11T07:28:14+00:00

i am asking myself if it would be dangerous on a asp.net page´s codebehind

  • 0

i am asking myself if it would be dangerous on a asp.net page´s codebehind to use an static (Shared) variable which holds an HMACSHA1-instance. the problem is that the same HMACSHA1-instance would be used by all the asp.net worker-process´ threads when processing multiple simultaneous requests on the same asp.net-page. all (HMACSHA1)instance- and ComputeHash()-method variables which are used/modified by ComputeHash() would be shared (= could be modified) by all the threads?! is that assumption correct? as a result the return value of ComputeHash would not be guaranteed to be correct?!?! thus i am not allowed to use an static/Shared HMACSHA1-instance over all the asp.net-threads..

i am just wondering what you think about this problem.

the only solution to this would be sth like an critical path etc in the ComputeHash()-method. but that is ‘out of our reach’..

regards, kris

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Hashing algorithms are deterministic, they must return the same hash for a given input every time.

    As long as you use the same key each time then there’s no need to make them static. However if you’re constructing the HMACSHA1 instance with the parameterless constructor then it generates a random key. You should be taking the random value from the KeyValue property and storing it with the hash.

    It is definitely dangerous to use a static instance. If Thread1 sets the value to be calculated, and then Thread2 sets the value before Thread1 calls ComputerHash() then Thread1 is going to get the hash of Thread2’s value. The same will happen if either thread is setting the key.

    • 0