If broken it is, fix it you should

Using the powers of the debugger to solve the problems of the world - and a bag of chips    by Tess Ferrandez, ASP.NET Escalation Engineer (Microsoft)

ASP.NET Viewstate error - Validation of viewstate MAC failed

ASP.NET Viewstate error - Validation of viewstate MAC failed

  • Comments 9

Last week I was working with on a case where they were getting this error message

HttpException (0x80004005): Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster

Typically this occurrs if the application is on a webfarm and autogenerate is used as the validation key.  This is because if you request a page and click a button for example, the postback may go to another server in the web farm and if the validation keys don't match, asp.net will consider the viewstate as invalid.

However, in this case, they were not on a web farm so none of this applied.  

Viewstate and viewstate validation use a couple of hidden form fields like __VIEWSTATE and __EVENTVALIDATION.  If the page renders so slowly that the __EVENTVALIDATION field has not rendered by the time someone clicks the button or control that causes the postback, ASP.NET will also believe that the viewstate is invalid and report this.  

I had gotten this far and in my case I also knew that the viewstate used was very large which of course causes the page to take longer to render so I asked them to reduce the viewstate as much as possible and review the page to determine why it took so long to render.  

I still recommend this, but this weekend I also read this article from my colleague Tom that gives more details along with some solutions for the issue and I thought I'd share it with you in case you don't subscribe to his blog.    

 

Later,

Tess

  • Aha! I think that's exactly the problem I'm having with a produciton web application I maintain. Thanks so much.

  • Just thought that I'd point out, that while writing my own blogging software (which, sadly is offline, due to a memory leak (I think) that would take down the server every 12 hours or so - haven't had time to look into it yet) I encountered this a lot with comment spamming bots. They try and post to the page directly with what they pulled earlier, which included a viewstate.

    Of course, trying later caused the viewstate to be invalid. It got so bad, that after I implemented an email function into the global.asax file for handling and reporting errors did I notice that it was averaging about 500+ a day. And my blog was by no means popular.

    On the flip side, it was interesting to see the bots that could load the page, grab a valid viewstate, and manage a successful post (which I was developing anti spam/keyword filtering on). On those, I averaged about 2 to 3 a day.

  • very interesting...

    I think in your case though you are probably running into this which is very similar (in fact same error message) but different cause...

    http://blogs.msdn.com/tess/archive/2007/06/11/a-case-of-invalid-viewstate.aspx

    I know what you're saying about the spammers, I easily also get around 500 a day which is a bit sad because I have had to turn on comment moderation for a while to avoid getting publishing the spam comments since most of the time they are highly offensive.   Lately they have also tried sending captcha text which is a bit ironic given that the blog doesnt use captcha but I guess they send out the same to all

    Community server seems to catch most of the spam comments though these days, so I am leaning more and more towards turning off comment moderation...    

  • Tess's If broken it is, fix it you should blog is always good for a read. Tess is an escalation engineer

  • I saw the same problem on an aspx page with a gridview.  All it was was a web tracker js file, at the bottom of the page, that was not getting downloaded.  I commented out the tracker and all was well.

    I can't decide if that's a bug in IE, the Framework, or the whole concept of ASP.Net!

  • Validation of viewstate MAC failed

    Update: In my case I was NOT using gridview nor DataKeyNames nor slow loading page.

    Small page with on two buttons, two text boxex, and dropdownlist. Clicking the button1 (add) caused the above error every time.

    Problem turned out to be the form action property was pointing to  a non-existent page! I used a code-behind method when the Add button is clicked and do not use form.submit. When I cleared the action property of the form, problem went away.

    My "guess" is that the form submit happens before

    the code-behind code is processed, since even in debug I would get the error before the breakpoint was hit.

    Hope this leads to the final answer to this.

    thanks!

    Mike.

  • this worked for me.

    <pages validateRequest="false" enableEventValidation="false" viewStateEncryptionMode ="Never" />

  • Mike, you saved me!

    I had tried every solution I could find for this problem, it turns out just the action property of my form tag was wrong.  Thank you very much!

  • Hey...

    i do all the things you

    mention in your post and disable the view and event state at application level in web.config, but still getting the same error but at a very low rate then previous one. Do smhtin ;)

Page 1 of 1 (9 items)
Leave a Comment
  • Please add 2 and 1 and type the answer here:
  • Post