Invalid Viewstate error and how to fix it?
We have been getting some questions regarding viewstate-related errors like “The viewstate is invalid for this page and might be corrupted”
This error is usually caused by the asp worker process or the server recycling. By default, ASP.NET encrypts the viewstate using an Autogenerated Key when the process spins up. The problem comes when a client (browser) sends the request with a viewstate encrypted with the key generated by another worker process. Since the key is different, ASP.NET will not be able to decrypt the viewstate and it will throw the above error.
There are several ways to get around this problem:
1) Host your site on a server that never restarts or recycles!!! Obviously, this is impossible!
2) Disable ViewstateMac by putting this “enableViewStateMac="false"” in your web.config. This approach is not 100% secure.
3) Configure ASP.NET to not use Auto-Generated Key but rather a predefined key. This is the preferred method.
To do this, follow these steps:
a) Either build your own Key Generator (http://support.microsoft.com/kb/313091/EN-US/) or use this tool (http://www.aspnetresources.com/tools/keycreator.aspx). I highly recommend you use the online tool. So assuming you will use the online tool:
b) In the online tool, simply click on “Generate”.
c) Copy the content in the textbox into your site’s web.config file. The machineKey node should be within <system.web>
eg.
<?xml version="1.0"?>
<configuration>
<appSettings/>
<connectionStrings/>
<system.web>
<machineKey
validationKey="2EEA416CEFC6D6BE856ED57B97FB9CA7DFACE17C073125949A1D682C80A44BB2A
D887DDDC13DBFB0954F1000FEE5757E99693F222F8E28CAA2E6DAB8C4F99E0C"
decryptionKey="877478B2F33A74226ABEF55FDCC1A76E43F1BBEA6241A592"
validation="SHA1" />
<compilation debug="false"/>
<authentication mode="Windows"/>
<pages enableViewStateMac="true"/>
</system.web>
</configuration>
For more information on viewstate troubleshooting, see http://support.microsoft.com/default.aspx?scid=kb;EN-US;829743
This error is usually caused by the asp worker process or the server recycling. By default, ASP.NET encrypts the viewstate using an Autogenerated Key when the process spins up. The problem comes when a client (browser) sends the request with a viewstate encrypted with the key generated by another worker process. Since the key is different, ASP.NET will not be able to decrypt the viewstate and it will throw the above error.
There are several ways to get around this problem:
1) Host your site on a server that never restarts or recycles!!! Obviously, this is impossible!
2) Disable ViewstateMac by putting this “enableViewStateMac="false"” in your web.config. This approach is not 100% secure.
3) Configure ASP.NET to not use Auto-Generated Key but rather a predefined key. This is the preferred method.
To do this, follow these steps:
a) Either build your own Key Generator (http://support.microsoft.com/kb/313091/EN-US/) or use this tool (http://www.aspnetresources.com/tools/keycreator.aspx). I highly recommend you use the online tool. So assuming you will use the online tool:
b) In the online tool, simply click on “Generate”.
c) Copy the content in the textbox into your site’s web.config file. The machineKey node should be within <system.web>
eg.
<?xml version="1.0"?>
<configuration>
<appSettings/>
<connectionStrings/>
<system.web>
<machineKey
validationKey="2EEA416CEFC6D6BE856ED57B97FB9CA7DFACE17C073125949A1D682C80A44BB2A
D887DDDC13DBFB0954F1000FEE5757E99693F222F8E28CAA2E6DAB8C4F99E0C"
decryptionKey="877478B2F33A74226ABEF55FDCC1A76E43F1BBEA6241A592"
validation="SHA1" />
<compilation debug="false"/>
<authentication mode="Windows"/>
<pages enableViewStateMac="true"/>
</system.web>
</configuration>
For more information on viewstate troubleshooting, see http://support.microsoft.com/default.aspx?scid=kb;EN-US;829743
