After upgrading to 9.3 portal says "Potentially dangerous behavior was detected"

Did you specify the trusted source key during installation of the API Server? It seems you did not.

Where can I find the trusted source key? Do I generate it? If so, how?

I admit I wasn't clear enough in my comment.

You normally specify the trusted source key during the wizard driven (GUI based) installation of the API Server.

That's what my question was. Did you specify the key during the installation?

Yes.

I tried this:
imxclient edit-config /path <web.config file path> /trustedsourcekey <Key>

with the key I entered in the installation but the same error occurred.

Do you know why Designer -> Web Server configurations -> ApiServer -> Program is empty?

It is empty by intention in 9.3 as the API Server can host more than one type of program (Web portal, Password Reset Portal, ...) that might require different authenticator settings.

So the imxclient option seems to be buggy.

Mmh... In that case - the API Server shouldn't come up with the error message.

Can you post (obfuscated of course) web.config and appsettings.json from the API Server?

web.config:

<?xml version="1.0"?>
<configuration>

  <connectionStrings configProtectionProvider="DataProtectionConfigurationProvider">
    <EncryptedData>
      <CipherData>
        <CipherValue>LoremipsumdolorsitametconsecteturadipiscingelitNullamviverramassaegetmolestielaciniafelistellussagittisjustoatlobortismagnadolordapibusnibhInaliquammassaidvolutpatvariusturpissapienvolutpatdolorquistristiqueauguedolorvelnuncFusceutlobortismetusVestibulumvulputatepurussitametnequemalesuadarhoncusNullambibendumveliteuquamscelerisqueblanditPellentesqueduifelisaliquetvitaedictumdapibusrhoncuseuerosIntegeratsapienconsequatdapibusmagnaegetsollicitudinlacusUtcursusaugueeuelitvehiculaegetegestasloremconsequatVivamusmetusloremtinciduntidblanditquissuscipitnonneque==</CipherValue>
      </CipherData>
    </EncryptedData>
  </connectionStrings>
  <system.web>

    <!-- MaxRequestLength in KB -->
    <httpRuntime enableVersionHeader="false" maxRequestLength="10240" executionTimeout="3600" />

  </system.web>

	<system.webServer>
  <handlers>
   <add name="aspNetCore" path="*" verb="*" modules="AspNetCoreModuleV2"
    resourceType="Unspecified" />
  </handlers>
  <aspNetCore processPath="dotnet" arguments=".\bin\QBM.CompositionApi.Server.AspNet.dll"
   startupTimeLimit="1200" stdoutLogEnabled="true" stdoutLogFile=".\App_Data\Logs"
   hostingModel="inprocess">
  </aspNetCore>
  <urlCompression doStaticCompression="true" doDynamicCompression="true" />
  <security>
   <requestFiltering>
    <requestLimits maxQueryString="32768" />
   </requestFiltering>
  </security>
 </system.webServer>
</configuration>

appsettings.json:

{
  "Settings": {
    "DeploymentTarget": "Server\\Web\\BusinessApiServer",
    "BaseURL": "https://acme.com/ApiServer/"
  },
  "ConnectionStrings": {},
  "RuntimeDirs": {
    "Cache": "C:\\inetpub\\wwwroot\\ApiServer\\App_Data\\Cache\\Cache",
    "AssemblyCache": "C:\\inetpub\\wwwroot\\ApiServer\\App_Data\\Cache\\AssemblyCache"
  },
  "ConnectionBehaviour": {
    "TokenCertificateThumbprint": "LOREMIPSUM",
    "CheckSessionCertificate": "True"
  }
}

Looks okay to me. Can you try to restart the server?

in addition.

What runtimes are installed?

Use the following command in a shell on the server hosting the weeb applications.

dotnet --list-runtimes

Looks okay to me. Can you try to restart the server?

in addition.

What runtimes are installed?

Use the following command in a shell on the server hosting the weeb applications.

dotnet --list-runtimes

Microsoft.AspNetCore.App 8.0.11
Microsoft.NETCore.App 8.0.11
Microsoft.WindowsDesktop.App 8.0.11

Restarting the server now.

Restart didn't help.

The only solution may be, that you have wrongly specified the trusted source key during the installation. The key must match the one specified in the configuration parameter in the database.

Please try to re-install the API Server and carefully check your provided trusted source key.

Which config parm?

Sorry. I meant QBMWebApplication.TrustedSourceKey.

So if you reinstall - you either need to provide the correct key or you can choose to overwrite the one stored in the database.

Uninstalled the old web application and even deleted a orphan in QBMWebApplication. Installed it again with a trusted source key and restarted both the IIS and the server.

But now it says "HTTP Error 404. The requested resource is not found." unless I change the FQDN to a custom web domain..most strange..

I changed the debugging from True to False and now I don't get any errors indicating potentially dangerous behavior.