nopSolutions/nopCommerce · warning · NopException

Admin.Configuration.Settings.GeneralCommon.EncryptionKey.The

Error message

Admin.Configuration.Settings.GeneralCommon.EncryptionKey.TheSame

What it means

Thrown by ChangeEncryptionKey (POST) when the new EncryptionKey equals the currently configured one. Rotation is a no-op in that case, so the action refuses with NopException using the localized 'TheSame' resource. It is a deliberate guard on a destructive operation.

Source

Thrown at src/Presentation/Nop.Web/Areas/Admin/Controllers/SettingController.cs:1783

    [FormValueRequired("changeencryptionkey")]
    [CheckPermission(StandardPermission.Configuration.MANAGE_SETTINGS)]
    public virtual async Task<IActionResult> ChangeEncryptionKey(GeneralCommonSettingsModel model)
    {
        var storeScope = await _storeContext.GetActiveStoreScopeConfigurationAsync();
        var securitySettings = await _settingService.LoadSettingAsync<SecuritySettings>(storeScope);

        try
        {
            if (model.SecuritySettings.EncryptionKey == null)
                model.SecuritySettings.EncryptionKey = string.Empty;

            var newEncryptionPrivateKey = model.SecuritySettings.EncryptionKey;
            if (string.IsNullOrEmpty(newEncryptionPrivateKey) || newEncryptionPrivateKey.Length != 16)
                throw new NopException(await _localizationService.GetResourceAsync("Admin.Configuration.Settings.GeneralCommon.EncryptionKey.TooShort"));

            var oldEncryptionPrivateKey = securitySettings.EncryptionKey;
            if (oldEncryptionPrivateKey == newEncryptionPrivateKey)
                throw new NopException(await _localizationService.GetResourceAsync("Admin.Configuration.Settings.GeneralCommon.EncryptionKey.TheSame"));

            //update password information
            //optimization - load only passwords with PasswordFormat.Encrypted
            var customerPasswords = await _customerService.GetCustomerPasswordsAsync(passwordFormat: PasswordFormat.Encrypted);
            foreach (var customerPassword in customerPasswords)
            {
                var decryptedPassword = _encryptionService.DecryptText(customerPassword.Password, oldEncryptionPrivateKey);
                var encryptedPassword = _encryptionService.EncryptText(decryptedPassword, newEncryptionPrivateKey);

                customerPassword.Password = encryptedPassword;
                await _customerService.UpdateCustomerPasswordAsync(customerPassword);
            }

            securitySettings.EncryptionKey = newEncryptionPrivateKey;
            await _settingService.SaveSettingAsync(securitySettings);
            await _eventPublisher.PublishAsync(new SecuritySettingsChangedEvent(securitySettings, oldEncryptionPrivateKey));

            _notificationService.SuccessNotification(await _localizationService.GetResourceAsync("Admin.Configuration.Settings.GeneralCommon.EncryptionKey.Changed"));

View on GitHub (pinned to 64bdf2ff08)

Solutions

Choose a different 16-char key distinct from the current SecuritySettings.EncryptionKey.
Display the current key fingerprint (not the key itself) so the operator can confirm they are changing it.
Pre-check equality client-side and disable submit when unchanged.
Document that key rotation requires a genuinely new key.

Example fix

// before
if (oldEncryptionPrivateKey == newEncryptionPrivateKey)
    throw new NopException(await _localizationService.GetResourceAsync("Admin.Configuration.Settings.GeneralCommon.EncryptionKey.TheSame"));

// after (graceful)
if (oldEncryptionPrivateKey == newEncryptionPrivateKey)
{
    _notificationService.ErrorNotification("New key must differ from the current key.");
    return View(model);
}

Defensive patterns

Strategy: validation

Validate before calling

if (newEncryptionPrivateKey == oldEncryptionPrivateKey)
    return ErrorResult("New key must differ from the current key.");

Type guard

static bool IsKeyChanging(string oldKey, string newKey)
    => !string.Equals(oldKey, newKey, StringComparison.Ordinal);

Try / catch

catch (NopException ex) when (ex.Message.Contains("EncryptionKey.TheSame"))
{ _notificationService.ErrorNotification("Choose a different key."); return View(model); }

Prevention

Show a fingerprint of the current key so operators detect sameness.
Disable submit when new == current.
Use a fresh random source for the new key.

When it happens

Trigger: Submitting the same key that is already in SecuritySettings.EncryptionKey; re-pasting the existing key after a failed rotation attempt; operator mistakenly re-entering the current value.

Common situations: Operator unsure which key is active and re-submits the current one; attempts to 're-apply' the same key; copy-paste from the same source as the original install.

Related errors

AI-assisted analysis of nopSolutions/nopCommerce@64bdf2ff08 (2026-08-13). Data as JSON: /api/errors/fb6556582314fab8. Report an issue: GitHub.