Validation of viewstate MAC failed

When adding a SharePoint webpart or an existing webpart’s properties we occasionally came across the following error. We did not use a web farm and none of the other suggestions in the error message made any sense in our case. We came across some solutions to this, which I’d like to share with you.

Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.

The easiest solution would be to just disable the ViewStateMac in your web.config file. But what does this actually mean? Setting this value to true means that ASP.NET should run a message authentication check (MAC) on the page’s view state when the page is posted back from the client. Setting it to false simply means that it will not perform the check. However, be aware of the consequences this might hold, because it might entail a security risk. After all, you disabled the check that verifies if your viewstate hasn’t been modified by an attacker. If this doesn’t do the trick you could always disable validation altogether.

But fully disabling validation of your viewstate could cause an even bigger security risk. Normally, a control registers its events when the page is being rendered and then validates the events during the post-back. Disabling this check skips the validation, so an attacker could spoof a postback that does not occur from a valid event and corrupt your application.

So far I have yet to find a solution that doesn’t come with a security risk of some sort. Hopefully at some point I will.

Steven | Computer | 05-03-2009 8:06 | 0 reacties

All opinions expressed on this site are my own and are, in no way, related to the company I work for.
All sponsored products, company names, brand names, trademarks and logos are the property of their respective owners.
Running on Wordpress, theme inspired by Yamidoo Magazine, built from the ground up by me.
© 2010 - Dvolve.org