Is This really an ASP.NET Web Forms Bug?

Question

I have a web application hosted by a set of load-balanced servers. I have an ASP.NET text box and button on the master page for getting a value and searching for it in the database. The search result is displayed on a page called search.aspx that takes a query string with the value entered in the text box placed on the master page.

The button on the master page simply Respose.Redirect to the search.aspx page with the query string mentioned.

Sometimes the search is performed peacefully, some other times the following exception is thrown:

Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.

I can't get the machine key be the same on all servers because they host other sites. I thought that this was because of the set of load-balanced servers. I tried EnableViewStateMac="false", ValidateRequest="false", EnableEventValidation="false" but it makes no difference.

I tried the following solution:

Set the PostBackUrl of the button on the master page to the search.aspx page and remove Response.Redirect in the Click event handler of the button.
Read the value of Request.Form["SearchCriteriaTextBox"] in the load of the search.aspx page.

But actually I found that it works when the pages don't inherit a master page and that's not my case. So What to do?????

Thank you for any help.

score 1 · Answer 1 · answered Jan 19 '10 at 08:14

You can override the machine key in the web.config:

<machineKey validation="SHA1"
    validationKey="ABC123..."
    decryption="Auto"
    decryptionKey="DEF567..." />

If you do this identically on each box, it only affects your site, and will prevent this error.

score 1 · Accepted Answer · edited May 23 '17 at 12:07

1

Take a look here: Validation of viewstate MAC failed

Seems you'll need to have the same validation keys inside your web.config on all servers. To get a new machine key, you can to use Pete's Nifty Machine Key Generator

edited May 23 '17 at 12:07

Community

1
1

answered Jan 19 '10 at 08:14

Rubens Farias

57,174
8
131
162

score 1 · Answer 3 · answered Jan 19 '10 at 08:15

1

You can set the machine key in the web.config file of your app so you don't affect the other sites on the servers.
See http://msdn.microsoft.com/en-us/library/ms998288.aspx#paght000007_webfarmdeploymentconsiderations

answered Jan 19 '10 at 08:15

AUSteve

3,238
21
36

Oded · Answer 4 · 2010-01-19T08:38:51.197

This isn't a bug, it is by design.

ViewState and other encrypted items use a validationKey and algorythm to get to a cypher text. In a webfarm, these need to be the same across all machines in order to match.

You can override this setting in your web.config:

<machineKey validation="SHA1"
  validationKey="ABC123..."
  decryption="Auto"
  decryptionKey="DEF567..." />

This should be done on every site that is part of the webfarm.

As suggested, you can use Pete's Nifty Machine Key Generator to generate this setting.

Is This really an ASP.NET Web Forms Bug?

4 Answers4