ASP.NET Validation of viewstate MAC failed

I’ve a listView to show list of data. It was all good and suddendly we are receiving the error message below:

Validation of viewstate MAC failed. If
this application is hosted by a Web
Farm or cluster, ensure that
configuration specifies the same
validationKey and validation
algorithm. AutoGenerate cannot be used
in a cluster.Invalid viewstate. Client
IP…User-Agent: Mozilla/4.0
(compatible; MSIE 7.0; Windows NT 5.1;
.NET CLR 1.1.4322; .NET CLR 2.0.50727;
.NET CLR 3.0.4506.2152; .NET CLR
3.5.30729; InfoPath.3) ViewState:

Could anyone please guide me through how to fix this issue. Please note:
1. Our IIS Server is standalone not a farmed.

Update:
The ListView has hyperlink to records where uses can click.
Thanks heaps.

Here is Solutions:

We have many solutions to this problem, But we recommend you to use the first solution because it is tested & true solution that will 100% work for you.

Solution 1

It could be that IIS recycled your app and therefore you get new keys for the session/view state. To alleviate this, add a machine static key in the web.config.

Generate a key from http://www.eggheadcafe.com/articles/GenerateMachineKey/GenerateMachineKey.aspx

And place the keys in your web.config example as below

<machineKey
validationKey="56AB7132992003EE87F74AE4D9675D65EED8018D3528C0B8874905B51940DEAF6B85F1D922D19AB8F69781B2326A2F978A064708822FD8C54ED74CADF8592E17"
decryptionKey="A69D80B92A16DFE1698DFE86D4CED630FA56D7C1661C8D05744449889B88E8DC"
validation="SHA1" decryption="AES" />

The <machineKey> should be put inside <system.web> section.

Solution 2

I think the problem is Different keys across postback,so you need to generate new encryption keys.

From Code Project:

There are two keys that ASP.NET uses
to encrypt, decrypt, and validate data
in ViewState, Forms Authetication
tickets, and out-of-process Session
data. The decryptionKey is used for
encryption and decryption of
authentication tickets and encrypted
ViewState information. The
validationKey is used to validate
ViewState and ensure it hasn’t been
tampered with, and generate unique
application-specific session IDs for
out-of-process session storage.
You can run into problems if the key changes between postbacks.


A good article how to do this here, here, here and here.

In general you need to take some issues in consideration when moving to the production environment.

A good article about this here.

Solution 3

Not knowing the specifics of your app, one way that this can happen if the page is submitted before it is fully loaded. You can work around by using javascript to prevent postbacks/submissions prior to the page being fully loaded. Also try to reduce the size of the page if possible. Disable the viewstate for any controls that you don’t use it.

Solution 4

This may occur on the other scenario when the Pool recycling happen before the Sql command execution complete, When your application dealing with large amount of data processing (such kind of report generation ..etc ) .Check the Application pool of your application and increase the recycling interval.

Solution 5

THis could possibly help you:

<%@ Page EnableViewStateMac="false" Language="C#" AutoEventWireup="true" CodeFile="Default2.aspx.cs" Inherits="Default2" %>

Note: EnableViewStateMac="false"

Note: Use and implement solution 1 because this method fully tested our system.
Thank you 🙂

All methods was sourced from stackoverflow.com or stackexchange.com, is licensed under cc by-sa 2.5, cc by-sa 3.0 and cc by-sa 4.0

Leave a Reply