Disable viewstate on IIS 7.5

We encountered a problem with viewstate encryption on Windows 2008 R2 and Windows 7. The page in question does a post with javascript to provide default values for parameters for another page. Only on IIS 7.5 this generates the error below.

[HttpException (0x80004005): Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.]

This is a feature of IIS to avoid tampering with the viewstate and cookies. The viewstate of Page X is posted to Page Y and fails the Message Authentication Code (MAC)

We don’t need the viewstate so we disable it. But even with EnableViewstate = “false” the server generated the __VIEWSTATE hidden field.

No more mister nice guy! :mrgreen: We added the javascript below in the post code to remove the viewstate. No more viewstate, no more exceptions.

TLDR

var vs = document.getElementById("__VIEWSTATE"); 
vs.parentNode.removeChild(vs);

Code from jberda answer on ASP.NET forum.

Caution

Disabling viewstate is not recommended. (Details) Use it wisely.

About erictummers

Working in a DevOps team is the best thing that happened to me. I like challenges and sharing the solutions with others. On my blog I’ll mostly post about my work, but expect an occasional home project, productivity tip and tooling review.
This entry was posted in Development and tagged , , , , , . Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.