I understand this error happens upon receiving a request with Viewstate truncated or modified (where it does not confirm to base64 encoding).
Different sources on the web point me to the following reasons why this error could occur with related to viewstate,
- Connection was interrupted while making the request
- Browser failed to send the complete request
- Client modifies the request before posting back to server
Among the possible reasons, the server will receive the said content length in header only in 3rd case.
Having said that,
- why aren't the other cases classified as Bad request by IIS?
- Why is this request even being handed over to ASP.NET if the content received does not match with content length in the request header?
Am I missing any basics here?? thanks.
//Update 1
Ok. here are more details from my analysis,
When the connection was interrupted or aborted by the client, ASP.NET throws an exception that is caught in the Application_Error of global.ascx.
Interestingly here again, we see the Request.ContentLength greater than Context.Request.TotalBytes.
To me this obviously means the request was fully received by server. This confirms that IIS is the right candidate to have handled this and not given the request to ASP.NET at all.
Is there any configuration in IIS to acheive this? Is there any other good reasons, why IIS is not doing this by default?