Why am I only randomly getting "Validation of viewstate MAC failed" in a single server environment?

Question

Yes, there are a million questions and threads on this particular error, with many well-documented solutions, which I will definitely try. But first I want to understand the problem for my particular situation/environment.

In my situation, this error seems to be entirely random. I will go weeks without seeing it, then one day I'll log into my site and get the error. Refresh the page, login again, and no problem. During these periods in between incidents, nothing particularly special has happened to the web server.

And that's the other thing, the error says "If this application is hosted by a Web Farm or cluster...", but it's not. It's just one single Windows Server 2008.

So, I understand the general solution is to add a set of static machine keys to the web.config file --- but why does this happen seemingly at random, and why does it happen to my site which is on a single Windows Server 2008 machine?

I'm using ASP.NET 4 and my site is a Web Application running on IIS.

Error Message:

Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that <machineKey> configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.

Stack Trace:

[ViewStateException: Invalid viewstate. 
    Client IP: ##::##:##:##:##
    Port: ##
    Referer: http://myserver/login.aspx
    Path: /login.aspx
    User-Agent: Opera/9.80 (Windows NT 6.1; WOW64; U; en) Presto/2.10.289 Version/12.01
    ViewState: /wEPDw...6OCX]

[HttpException (0x80004005): Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that <machineKey> configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.]
   System.Web.UI.ViewStateException.ThrowError(Exception inner, String persistedState, String errorPageMessage, Boolean macValidationError) +235
   System.Web.UI.ViewStateException.ThrowMacValidationError(Exception inner, String persistedState) +14
   System.Web.UI.ObjectStateFormatter.Deserialize(String inputString) +274
   System.Web.UI.ObjectStateFormatter.System.Web.UI.IStateFormatter.Deserialize(String serializedState) +4
   System.Web.UI.Util.DeserializeWithAssert(IStateFormatter formatter, String serializedState) +37
   System.Web.UI.HiddenFieldPageStatePersister.Load() +241
   System.Web.UI.Page.LoadPageStateFromPersistenceMedium() +106
   System.Web.UI.Page.LoadAllState() +43
   System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +8431
   System.Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +253
   System.Web.UI.Page.ProcessRequest() +78
   System.Web.UI.Page.ProcessRequestWithNoAssert(HttpContext context) +21
   System.Web.UI.Page.ProcessRequest(HttpContext context) +49
   ASP.login_aspx.ProcessRequest(HttpContext context) +4
   System.Web.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +100
   System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +75

Are you dynamically adding controls, depending upon certain conditions? — nunespascal, Aug 20 '12 at 04:50
Thanks for replying. No, I'm not dynamically adding any controls. — CptSupermrkt, Aug 20 '12 at 04:59

score 5 · Answer 1 · edited May 23 '17 at 12:07

From your log, I suggest you to check one thing - Did you connect any parameter from your user with the Viewstate that can be changed if the user is logged in/logged out? - or change for any other reason, e.g. because session is expired or changed.

This parameter can be different between the saved and the current Viewstate and this can break the page.

For example this code can do that:

ViewStateUserKey = CurrentUserCookie;

Or this one as it is:

ViewStateUserKey = User.Identity.Name

Also read this answer: https://stackoverflow.com/a/2551810/159270

This is similar: ViewStateUserKey + shared hosting + ViewStateMac validation failure

And Some reference: http://www.hanselman.com/blog/ViewStateUserKeyMakesViewStateMoreTamperresistant.aspx
http://msdn.microsoft.com/en-us/library/ms972969.aspx

The random errors are the nightmare of any developer.

Why am I only *randomly* getting "Validation of viewstate MAC failed" in a single server environment?

1 Answers1

Why am I only randomly getting "Validation of viewstate MAC failed" in a single server environment?