ASP .NET ViewState Validation Errors

Navigation

ASP .NET ViewState Validation Errors

Tess's If broken it is, fix it you should blog is always good for a read. Tess is an escalation engineer in the Microsoft Product Support Service dealing with .NET and her blog has lots of good info on thorny problems that crop up now and again.

I came across a post on her blog the other day about the ASP.NET Viewstate error - Validation of viewstate MAC failed error occurring on servers that are not part of a web farm. This problem has plagued me on a couple of ASP .NET projects that I've worked on and in one case we were forced to ship an application to a client with viewstate validation disabled as it was the only way we could overcome the problem.

In this instance Tess doesn't offer many solutions but refers to a post by her colleague Tom which does offer a couple of possible solutions. He has a couple of good ideas which I hadn't come across before so if you have this problem they may be worth a try.

I came across another useful solution a while ago which I have used a couple of times. You can avoid viewstate validation error by maintaining the viewstate on the server and not shipping it to the client with each page response. This can be done by overriding the LoadPageStateFromPersistenceMedium and SavePageStateToPersistenceMedium methods in a page, as shown below. I tend to do this in a base class so that all viewstate is persisted on the server.

        protected override object LoadPageStateFromPersistenceMedium ()
        {
            return Session["_ViewState"];
        }

        protected override void SavePageStateToPersistenceMedium ( object viewState )
        {
            Session["_ViewState"] = viewState;
        }

The above approach works well if your web application is lightly loaded and running on a single server but if you are running on a web farm you will need to use external state persistence (database or filesystem) to store the viewstate. This will add overhead that will probably impact the performance of your application. There is however an added side-effect of this method; without the encrypted viewstate in hidden form controls the HTML page is actually smaller and will take less time to transfer to the client.