ASP.NET Validation of viewstate MAC failed

Question

I've a listView to show list of data. It was all good and suddendly we are receiving the error message below:

Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.Invalid viewstate. Client IP...User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; InfoPath.3) ViewState:

Could anyone please guide me through how to fix this issue. Please note: 1. Our IIS Server is standalone not a farmed.

Update: The ListView has hyperlink to records where uses can click. Thanks heaps.

Just encountered this error in testing, when setting the client to disallow accepting cookies, and trying to login to an app. Rather bizarre circumstance. Same behavior on my (win7) localhost and a win2008 server. — fortboise, Mar 18 '17 at 14:54

score 32 · Accepted Answer · answered Jun 07 '11 at 02:54

It could be that IIS recycled your app and therefore you get new keys for the session/view state. To alleviate this, add a machine static key in the web.config.

Generate a key from http://www.eggheadcafe.com/articles/GenerateMachineKey/GenerateMachineKey.aspx

And place the keys in your web.config example as below

<machineKey
validationKey="56AB7132992003EE87F74AE4D9675D65EED8018D3528C0B8874905B51940DEAF6B85F1D922D19AB8F69781B2326A2F978A064708822FD8C54ED74CADF8592E17"
decryptionKey="A69D80B92A16DFE1698DFE86D4CED630FA56D7C1661C8D05744449889B88E8DC"
validation="SHA1" decryption="AES" />

The <machineKey> should be put inside <system.web> section.

score 5 · Answer 2 · edited Mar 25 '19 at 14:10

I think the problem is Different keys across postback,so you need to generate new encryption keys.

From Code Project:

There are two keys that ASP.NET uses to encrypt, decrypt, and validate data in ViewState, Forms Authetication tickets, and out-of-process Session data. The decryptionKey is used for encryption and decryption of authentication tickets and encrypted ViewState information. The validationKey is used to validate ViewState and ensure it hasn't been tampered with, and generate unique application-specific session IDs for out-of-process session storage. You can run into problems if the key changes between postbacks.

A good article how to do this here, here, here and here.

In general you need to take some issues in consideration when moving to the production environment.

A good article about this here.

score 2 · Answer 3 · answered Jun 07 '11 at 01:46

2

Not knowing the specifics of your app, one way that this can happen if the page is submitted before it is fully loaded. You can work around by using javascript to prevent postbacks/submissions prior to the page being fully loaded. Also try to reduce the size of the page if possible. Disable the viewstate for any controls that you don't use it.

answered Jun 07 '11 at 01:46

mikey

5,090
3
24
27

The ListView has hyperlink to records where uses can click. – Nil Pun Jun 07 '11 at 01:48
could Mozilla browser be causing this issue?? – Nil Pun Jun 07 '11 at 01:57

score 0 · Answer 4 · answered Dec 10 '18 at 17:25

This may occur on the other scenario when the Pool recycling happen before the Sql command execution complete, When your application dealing with large amount of data processing (such kind of report generation ..etc ) .Check the Application pool of your application and increase the recycling interval.

score -2 · Answer 5 · edited Dec 10 '20 at 16:23

-2

THis could possibly help you:

<%@ Page EnableViewStateMac="false" Language="C#" AutoEventWireup="true" CodeFile="Default2.aspx.cs" Inherits="Default2" %>

Note: EnableViewStateMac="false"

edited Dec 10 '20 at 16:23

Chris Catignani

5,040
16
42
49

answered Jun 05 '14 at 09:20

long nguyen

11
1

1

Could you explain in what it help? – DrakaSAN Jun 05 '14 at 09:45
2

Should not do this. If you make it false, ASP.NET will stop checking if the ViewState has been tampered with. This is like inviting hackers to hack your application. – DanKodi Jul 16 '14 at 11:50
3

If your security system is giving you false alarms is the correct solution to **fix the security system** or **turn it off and hope for the best**? – Eric Lippert Dec 15 '14 at 20:01
1

I just have to reiterate: don't ever do this. – sovemp Jan 28 '16 at 00:51

ASP.NET Validation of viewstate MAC failed

5 Answers5

Linked