The Dreaded ViewState Error

[andrewsmd]

So I had a client update their website which is built in .net and now I get this whenever I try to execute an aspx page.

Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that <machineKey> configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.

I DID do research before I posted here so please don't post any links about changing the <pages> section of my web.config because I already tried it. Does anyone have any ideas about how I can troubleshoot this?

Couple tid bits. This is a stand alone Win 2k8 r2 server running .net 3.5 (although I think the site still works on 2. something) Any thoughts?

[mattglet]

If you tried the <pages> stuff, it's probably a code issue. Obviously going to be hard to figure out, but you can start by narrowing it down to any controls that are used/created OnLoad, OnPreInit, etc.

[andrewsmd]

So you're saying create a blank page and then start adding controls to it until it breaks?

[Ocean10000]

I am going to assume you have tried these already.
<pages renderAllHiddenFieldsAtTopOfForm="false" /> <-- this would fix it if it wasn't finished loading the page before the postback was triggered.

<pages enableViewStateMac="false" /> <-- This turns off the checksum checks of the viewstate data when it is posted back.

<pages MaxPageStateFieldLength="2024" /> <-- split the ViewState's single hidden field into several, to work around some proxie/firewall issues with large hidden fields.

Have you checked if you have two nested forms on the page? This is another common cause of this due to how easy it is to do with master pages.

[andrewsmd]

I tried the pages thing. The login page (where I'm getting the error) has no master page. I also tried updating to 3.5 and adding a machine key. Any other ideas?

[Ocean10000]

Are there any other form fields on the page or anything else that saves to the ViewState?

[mattglet]

If your page is only a few hundred lines long, I wouldn't mind taking a look at it.

[andrewsmd]

I can post the whole thing maybe but I noticed this.

<input type="hidden" name="__EVENTTARGET" id="__EVENTTARGET" value="" />
<input type="hidden" name="__EVENTARGUMENT" id="__EVENTARGUMENT" value="" />
<input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" value="/wEPDwULLTExMTAwMzYyNDdkZC+DL9vIjZGvVNEwSpcgEqvHmaVM" />

Would that last input have anything to do with it? Could I just remove it? If not, then I'll post my page, I just don't like to do that because I hate it when other people just post a page and say "this is broken fix it for me" :).

Update: when I removed them, then nothing happened when I clicked login. I've never worked with anything like this in .net so any help would be great!

[mattglet]

Those fields are actually auto-generated by .NET, and are what help with transitioning data during Postbacks. The __VIEWSTATE field specifically holds the encrypted data that needs to persist through to the page upon postback (e.g. clicking a Submit button, clicking a LinkButton, etc.). In a nutshell, don't mess with those inputs :)

[andrewsmd]

These inputs where actually in the aspx file.

[Ocean10000]

Those hidden inputs should not be in the raw unprocessed aspx file, if it is this might be part of the problem.

[andrewsmd]

But when I remove them, then the page does not do anything when you click submit. Any ideas why?

[mattglet]

Do you have an OnClick event specified for your submit button?

[andrewsmd]

No, the form tag is where this happens i.e. <form action="login.aspx.vb">

[mattglet]

If your Submit button is a <asp:Button />, you need to have an OnClick event which corresponds to a method in the code-behind. In this method you "do stuff" (save the data entered in the form, etc.)

[msdn.microsoft.com...]