Invalid viewstate for ScriptResource.axd?

Question

The Script Resource and the Web Resource files are generating intermittent errors in my application. I have been trying to chase the cause of the problem but to no avail. I notice that the “d” parameter that is passed is some how corrupted and I can’t for the life of me figure out what’s causing this parameter to be corrupted. I noticed that JavaScript code that in my application is some how getting intertwined with the hash code that’s generated for the “d” parameter.

Exception genereated on Monday, January 26, 2009, at 2:20 AM
Page location: /ScriptResource.axd?d=y9_dUwBeGqLlRpT5Dml1zhoQvfa7NKdj69EYuV771kzSsa5KOOXBfJZjk%20%20%20%20%20%20%20%20%20%20%20%20if%20(cat_gallery%20!=
Requested Url : http://garmn.factoryoutletstore.com/ScriptResource.axd?d=y9_dUwBeGqLlRpT5Dml1zhoQvfa7NKdj69EYuV771kzSsa5KOOXBfJZjk if (cat_gallery !=
Message: Exception has been thrown by the target of an invocation.
Source: mscorlib
Method: System.Object _InvokeMethodFast(System.Object, System.Object[], System.SignatureStruct ByRef, System.Reflection.MethodAttributes, System.RuntimeTypeHandle)
Stack Trace: at System.RuntimeMethodHandle._InvokeMethodFast(Object target, Object[] arguments, SignatureStruct& sig, MethodAttributes methodAttributes, RuntimeTypeHandle typeOwner) at System.RuntimeMethodHandle.InvokeMethodFast(Object target, Object[] arguments, Signature sig, MethodAttributes methodAttributes, RuntimeTypeHandle typeOwner) at System.Reflection.RuntimeMethodInfo.Invoke(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture, Boolean skipVisibilityChecks) at System.Reflection.RuntimeMethodInfo.Invoke(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture) at System.Reflection.MethodBase.Invoke(Object obj, Object[] parameters) at System.Web.Handlers.ScriptResourceHandler.DecryptString(String s) at System.Web.Handlers.ScriptResourceHandler.DecryptParameter(NameValueCollection queryString) at System.Web.Handlers.ScriptResourceHandler.ProcessRequest(HttpContext context) at System.Web.Handlers.ScriptResourceHandler.System.Web.IHttpHandler.ProcessRequest(HttpContext context) at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)
Inner Exception: System.Web.HttpException: Invalid viewstate. at System.Web.UI.Page.DecryptStringWithIV(String s, IVType ivType) at System.Web.UI.Page.DecryptString(String s)
User IP: 74.34.62.187

BaseMessage : Exception genereated on Monday, January 26, 2009, at 2:20 AM
Page location: /ScriptResource.axd?d=y9_dUwBeGqLlRpT5Dml1zhoQvfa7NKdj69EYuV771kzSsa5KOOXBfJZjk%20%20%20%20%20%20%20%20%20%20%20%20if%20(cat_gallery%20!=
Requested Url : http://garmn.factoryoutletstore.com/ScriptResource.axd?d=y9_dUwBeGqLlRpT5Dml1zhoQvfa7NKdj69EYuV771kzSsa5KOOXBfJZjk if (cat_gallery !=
Message: Invalid viewstate.
Source: System.Web
Method: System.String DecryptStringWithIV(System.String, System.Web.Configuration.IVType)
Stack Trace: at System.Web.UI.Page.DecryptStringWithIV(String s, IVType ivType) at System.Web.UI.Page.DecryptString(String s)
User IP: 74.34.62.187
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.04506; .NET CLR 1.1.4322; Zune 3.0)

Answer 1

I have been analyzing the data that I have been collecting and I have drawn a few conclusions. I noticed that a large majority of the errors that I have been getting are coming from windows Vista computers running IE 8 or Firefox 3. There where also a few cases where it was Vista and IE 7. This could explain why the errors are now just becoming an issue as more and more people are using the new operating system.

Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; FunWebProducts; .NET CLR 1.1.4322; .NET CLR 2.0.50727) Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GoogleT5; MSN Optimized;CA; MSN Optimized;CA) Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; WOW64; Trident/4.0; GTB5; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.04506; Media Center PC 5.0)

But anyways the conclusion that I want to get at is that based on this information I started looking into how the browsers process java scripts and if there was anything new that could be causing this issue, that’s when something interesting pop out at me, I found on the w3School website an article about the difference in html vs. xhtml.

Differences between HTML and XHTML HTML 4 and XHTML deal different with the content inside scripts:

In HTML 4, the content type is declared as CDATA, which means that entities will not be parsed. In XHTML, the content type is declared as (#PCDATA), which means that entities will be parsed. This means that in XHTML, all special characters should be encoded or all content should be wrapped inside a CDATA section.

To ensure that a script parses correctly in an XHTML document, use the following syntax:

So I immediately took a look into my code and I saw that the DOCTYPE directive was missing on some of my pages the sameones that are causing the Issue. I also noticed that where I was outputting JavaScript using the .NET Register Client Script routine it would wrap the inner content of the script tags with the CDATA attribute, while where there was the regular JavaScript written on the page there was no CDATA used. For example

Function RunMe() { }

I am no expert on how browser’s renders or parse the html return, but I strongly believe it has some thing to do with the situation above because the Url parameter in the Script Resource request whenever it crashes always contains code in between script tags that's below it. Some times there is even html style sheet code that can be found there as well. For example

http://braun.factoryoutletstore.com/ScriptResource.axd?d=70kBR-jPBTx9R89FxObjhipHPS9CMlta5W6ZZiqkaa5zNOXUU4DtsY8V_8function runSearchForField(eventObj, id){ if ((eventObj.which == 13) || (eventObj.keyCode == 13)) { var cat_gallery = getParam('gallery'); var cat = getParam('cat') var searchTerm = escape(document.getElementById(id).value); // must use escape() function to urlencode search term to avoid issues with '&' and '=' symbols var url; if (cat_

http://braun.factoryoutletstore.com/ScriptResource.axd?d=9vS7Hk65j_0hD8to_aPDj

Now what am thinking is that some how because am not specifying any DOCTYPE in the page the browser might be trying to infer based on the data its receiving then it ends up messing up because sometimes there is CDATA and there are times when there is no CDATA present in the page. I don’t know really if this is a solid assumption cause as they say assumptions as dangerous. If anyone can shade some light on my theory and let me know if the browsers are parsing the xhtml differently that older version or even if they had any similar situations.

Answer 2

We've experienced the same and it appears to be related to a bug in IE8's rendering engine.

Take a look at the following resources: http://blogs.msdn.com/ieinternals/archive/2009/07/27/Bugs-in-the-IE8-Lookahead-Downloader.aspx http://connect.microsoft.com/IE/feedback/ViewFeedback.aspx?FeedbackID=467062

Basically there are a few tags on the page that are causing a "parser restart" which causes 4K of the HTML in the page to be omitted. This means that the browser is putting HTML on to the ScriptResource.axd that occurs 4096 bytes later in the page.

Answer 3

I think these errors happen with different browsers for different reasons, which is what makes it so hard to track down.

IE8 Bug

Microsoft have said a bug in IE8 will (in some circumstances) generate spurious requests to the server, that do not affect the user but do lead to errors being logged at the server side.

See this discussion here: Bug IE8 – 4K dropped - "Invalid viewstate" when loading ScriptResource.axd

... particularly EricLaw-MSFT's update when he says:

It is worth mentioning that anyone who is experiencing a problem here in IE6/IE7 or Firefox is encountering a different problem that is not related to the IE8 issue described below.

See also Bugs in IE8's Lookahead Downloader

They say changing the way you set Content-Type will help with some of the errors, although not all of them - they say it is caused by various obscure circumstances that they are still looking at.

Update: As of 01/Apr/2010, these IE8 bugs have been fixed, via IE8 Cumulative Update (KB980182).
This post: IE8 Lookahead Downloader Fixed gives more detail on the bugs and other possible workarounds other than waiting for everyone in the world to download the fix.

Other Browsers

Haven't figured it out yet, but other browsers are also generating these errors, presumably for different reasons.

Web Farms

This problem is not restricted to sites running on web farms, but if you are running a farm, check out this answer by jesal which may help

Answer 4

Ok, welcome to the living hell that is MS ajax.

this bit is interesting

Requested Url : http://garmn.factoryoutletstore.com/ScriptResource.axd?d=y9_dUwBeGqLlRpT5Dml1zhoQvfa7NKdj69EYuV771kzSsa5KOOXBfJZjk if (cat_gallery != Message: Invalid viewstate

that "if (cat_gallery !=" looks sort of out of place. I would look at the javascript around that if and see if there is anything that looks fishy

Assuming you are using update panels, that bit about invalid viewstate leads me to think that viewstate is getting borked between partial requests. My guess (not based on fact, more on experience and pain) is that it is one of two things; either you have multiple panels and state is getting out of whack (panel 1 updates state, panel 2 fires right after and doesnt pick up the changes), or that it is page lifecycle related (i have seen multiple databinds cause invalid viewstate in partial page postbacks)

I would say first thing is to try and reproduce the error. Go to the page that it happens on, and try every combination of behavior you can think of. Once you have a reproducible bug, attach a debugger and put breakpoints all over, then just step through the page lifecycle and see if there are any code paths wandering in directions you didn't anticipate.

Either way, MS AJAX is extremely black-boxish, so debugging issues around it can be excruciatingly difficult (spent about 20 hours doing what I just recommended to you last week) I wish you the best of luck, and really hope that this helps you down the right path.

Answer 5

These errors tend to happen if you are hosting your site on a load-balancing cluster or in a web farm. If you deploy your application in that environment, you must ensure that the configuration files on each server share the same value for validationKey and decryptionKey, which are used for hashing and decryption respectively. This is required because you cannot guarantee which server will handle successive requests.

With manually generated key values, the settings should be similar to the following example. Please make sure element is underneath section in the web.config file.

<machineKey validationKey="0BE61B38B9836B541C45728ADB9D93A6FD819169DBB6AD20078A70F474650CC0295C69131E083A6B3762C457BBAF3E66E18F294FDA434B9DD6758631A90A2E20" decryptionKey="B80CC12266B36CCF35EF0708DB5854EDA3BBEBA1A7C89A4E" validation="SHA1"/>

Here's a nifty little key generator which you can use to generate the key values - http://www.eggheadcafe.com/articles/GenerateMachineKey/GenerateMachineKey.aspx

So as you might have guessed, the d parameter in the ScriptResource.axd is actually the decryption key, and when that key does not match with the previous request .NET framework will throw an invalid view state error.

Hope that helps!

Answer 6

Hey Matt Thanks a lot for you Help. Ok this is what I have Notice in my analysis, this Request seems to be always intertwined with the same JavaScript code, I have included a line from my error log that shows the requested Url that caused the issue.

/ScriptResource.axd?d=70kBR-jPBTx9R89FxObjhipHPS9CMlta5StoreUrl'%20is%20already%20set.%20*/function%20runSearchForField(eventObj,%20id){%20%20%20%20if%20((eventObj.which%20==%2013)%20||%20(eventObj.keyCode%20==%2013))%20%20%20%20%20{%20%20%20%20%20%20%20%20var%20cat_gallery%20=%20%20getParam('gallery');%20%20%20%20%20%20%20%20var%20cat%20=%20getParam('cat')%20%20%20%20%20%20%20%20var%20searchTerm%20=%20escape(document.getElementById(id).value);%20//%20must%20use%20escape()%20function%20to%20urlencode%20search%20term%20to%20avoid%20issues%20with%20'&'%20and%20'='%20symbols%20%20%20%20%20%20%20%20var%20url;%20%20%20%20%20%20%20%20%20%20%20%20if%20(cat_gallery%20!=

as you can see the "d" parameter is corrupted. What happens here is that the System.Web.UI.Page.DecryptString will throw an Invalid view state error when it tries to decrypt this string. What I would like to know is how can this string become this corrupted. I took a look at the JavaScript and everything seems ok to me, the only odd thing is that there are some comments in the code which is comment with /* to denote that the line are just comments. I am not using Nested panels but I do I have one update panel on the page.

Answer 7

This might be a dumb answer, but have you checked your session state manager? the default is IN PROC which does not work with a web farm, you need to use SQL or some other state manager.