viewstate error

[scottrm]

Hi

Users seem to be getting the following intermitent error whe they post a
form.

Validation of viewstate MAC failed. If this application is hosted by a
Web Farm or cluster, ensure that <machineKeyconf iguration specifies
the same validationKey and validation algorithm. AutoGenerate cannot be
used in a cluster.

We are not in a cluster situation. I believe it may be because there is a
delay in posting back so the viewstate is expiring. I wanted to know if there
is any way to increase the timeout of the view state, is it bound to the
session timeout (we are not using forms authentication) ?

Alternatively any way to turn this viewstate check off (it is a restriced
admin site so there should be no security problems although I would prefer
just to extend the timeout)


--
Scott

[Cowboy \(Gregory A. Beamer\)]

ViewState does not timeout. It is an encrypted string in your page (hidden
field). There is a setting on the @Page directive for ViewStateMac. Set it
both ways (forget which setting cures this, but a google might solve it).
The second thing to do is generate your keys. You can find machineKey
generators on the web.

--
Gregory A. Beamer
MVP; MCP: +I, SE, SD, DBA
http://gregorybeamer.spaces.live.com

*************** *************** *************** ****
Think outside of the box!
*************** *************** *************** ****
"scottrm" <sc*****@newsgr oup.nospamwrote in message
news:44******** *************** ***********@mic rosoft.com...

Hi

Users seem to be getting the following intermitent error whe they post a
form.

Validation of viewstate MAC failed. If this application is hosted by a
Web Farm or cluster, ensure that <machineKeyconf iguration specifies
the same validationKey and validation algorithm. AutoGenerate cannot be
used in a cluster.

We are not in a cluster situation. I believe it may be because there is a
delay in posting back so the viewstate is expiring. I wanted to know if
there
is any way to increase the timeout of the view state, is it bound to the
session timeout (we are not using forms authentication) ?

Alternatively any way to turn this viewstate check off (it is a restriced
admin site so there should be no security problems although I would prefer
just to extend the timeout)


--
Scott

[scottrm]

Hi

Thanks for your reply, I think I was not being that clear, I am aware view
state itself does not time out as such but according to what I read "
ASP.NET will perform a simple digest on the viewstate and check it later
when page postback, however, this digest is not valid forever"

Also would setting the key make any difference in a non-cluster environment.

Scott
--
Scott
"Cowboy (Gregory A. Beamer)" wrote:

ViewState does not timeout. It is an encrypted string in your page (hidden
field). There is a setting on the @Page directive for ViewStateMac. Set it
both ways (forget which setting cures this, but a google might solve it).
The second thing to do is generate your keys. You can find machineKey
generators on the web.

--
Gregory A. Beamer
MVP; MCP: +I, SE, SD, DBA
http://gregorybeamer.spaces.live.com

*************** *************** *************** ****
Think outside of the box!
*************** *************** *************** ****
"scottrm" <sc*****@newsgr oup.nospamwrote in message
news:44******** *************** ***********@mic rosoft.com...

Hi

Users seem to be getting the following intermitent error whe they post a
form.

Validation of viewstate MAC failed. If this application is hosted by a
Web Farm or cluster, ensure that <machineKeyconf iguration specifies
the same validationKey and validation algorithm. AutoGenerate cannot be
used in a cluster.

We are not in a cluster situation. I believe it may be because there is a
delay in posting back so the viewstate is expiring. I wanted to know if
there
is any way to increase the timeout of the view state, is it bound to the
session timeout (we are not using forms authentication) ?

Alternatively any way to turn this viewstate check off (it is a restriced
admin site so there should be no security problems although I would prefer
just to extend the timeout)


--
Scott

[David R. Longnecker]

There's a web.config key that you can set to enable or disable the ViewStateMac
setting.

In your <pagestag, add enableViewState Mac="true" or enableViewState Mac="false".

-dl

--
David Longnecker
Web Developer
http://blog.tiredstudent.com

Hi

Users seem to be getting the following intermitent error whe they post
a form.

Validation of viewstate MAC failed. If this application is hosted by a
Web Farm or cluster, ensure that <machineKeyconf iguration specifies
the same validationKey and validation algorithm. AutoGenerate cannot
be used in a cluster.

We are not in a cluster situation. I believe it may be because there
is a delay in posting back so the viewstate is expiring. I wanted to
know if there is any way to increase the timeout of the view state, is
it bound to the session timeout (we are not using forms
authentication) ?

Alternatively any way to turn this viewstate check off (it is a
restriced admin site so there should be no security problems although
I would prefer just to extend the timeout)

[Steven Cheng[MSFT]]

Hello Scott,

As for the ViewState validation error you encountered, there does exists
some issue that will result to the behavior. One is hosting web applicaiton
in webfarm environment which cause request send to different server (with
different machinekey) raise viewstate validation error. Another problem is
as you said, the ViewStateMac(en abled by default) is a randomly generated
digest value and it is not expected to work forever, and that's why
sometimes the server will also raise such error when use pickup a url from
the webcrawler's search result cache(which contains invalid viewstate
content).

So far, the ASP.NET's ViewState setting only provide the
"EnableViewStat eMac" and "viewStateEncry ptionMode" two configuration
options, and the "viewStateEncry ptionMode" is specific to viewstate
encryption which is not used normally. As for ViewStateMac, we can only
control whether to enable it, but can not control the valid lifecycle of
the generated MAC value(it is internally fixed). BTW, since the error
will raise occasionally when the user postback a form after a long period
idle, do you think it possible that you embed some client-script in your
certain page (which need such protetion) and automatically postback the
form after a certain long period? Thus, if the user hasn't perform any
action on the form for a long time, the page will postback itself to make
its states refresh. Also, you can disable ViewStatemac for the certain
pages, however, there will still raise server-side exception when the
ViewState is corrupted.

Please feel free to post here if you have any other ideas or questions.

Sincerely,

Steven Cheng

Microsoft MSDN Online Support Lead

=============== =============== =============== =====

Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscripti...ult.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at
http://msdn.microsoft.com/subscripti...t/default.aspx.

=============== =============== =============== =====

This posting is provided "AS IS" with no warranties, and confers no rights.

[scottrm]

Hi

Thanks for your reply, does the sentence "Also, you can disable ViewStatemac
for the certain pages, however, there will still raise server-side exception
when the
ViewState is corrupted." mean that changing the ViewStatemac setting even in
the web.config will not necessarily fix the problem?

Scott
--
Scott
"Steven Cheng[MSFT]" wrote:

Hello Scott,

As for the ViewState validation error you encountered, there does exists
some issue that will result to the behavior. One is hosting web applicaiton
in webfarm environment which cause request send to different server (with
different machinekey) raise viewstate validation error. Another problem is
as you said, the ViewStateMac(en abled by default) is a randomly generated
digest value and it is not expected to work forever, and that's why
sometimes the server will also raise such error when use pickup a url from
the webcrawler's search result cache(which contains invalid viewstate
content).

So far, the ASP.NET's ViewState setting only provide the
"EnableViewStat eMac" and "viewStateEncry ptionMode" two configuration
options, and the "viewStateEncry ptionMode" is specific to viewstate
encryption which is not used normally. As for ViewStateMac, we can only
control whether to enable it, but can not control the valid lifecycle of
the generated MAC value(it is internally fixed). BTW, since the error
will raise occasionally when the user postback a form after a long period
idle, do you think it possible that you embed some client-script in your
certain page (which need such protetion) and automatically postback the
form after a certain long period? Thus, if the user hasn't perform any
action on the form for a long time, the page will postback itself to make
its states refresh. Also, you can disable ViewStatemac for the certain
pages, however, there will still raise server-side exception when the
ViewState is corrupted.

Please feel free to post here if you have any other ideas or questions.

Sincerely,

Steven Cheng

Microsoft MSDN Online Support Lead

=============== =============== =============== =====

Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscripti...ult.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at
http://msdn.microsoft.com/subscripti...t/default.aspx.

=============== =============== =============== =====

This posting is provided "AS IS" with no warranties, and confers no rights.

[Steven Cheng[MSFT]]

Thanks for your reply Scott,

Yes, IMO "turn off ViewStateMac" is not the way to fix the problem. This is
because if we turn off the ViewStateMac check, when a problem page (with
invalid viewstate) postback, the server-side will not verify the viewstate
since MAC is turned off, however, when the page framework parse the
viewstate, it will encounter problem which will raise some unexpected error
and this will be more ambiguous than a ViewState validation error. Do you
think so?

Sincerely,

Steven Cheng

Microsoft MSDN Online Support Lead
This posting is provided "AS IS" with no warranties, and confers no rights.