Share via

Validation of viewstate MAC failed after installing .NET 3.5 SP1

  • Article

After installing .NET 3.5 SP1 you may get Validation of viewstate MAC failed exceptions when doing post backs on ASP.NET pages

Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that <machineKey> configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.

Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.
Exception Details: System.Web.HttpException: Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that <machineKey> configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.

Stack Trace:

 [HttpException (0x80004005): Unable to validate data.]
   System.Web.Configuration.MachineKeySection.GetDecodedData(Byte[] buf, Byte[] modifier, Int32 start, Int32 length, Int32& dataLength) +289
   System.Web.UI.ObjectStateFormatter.Deserialize(String inputString) +140

[ViewStateException: Invalid viewstate. 
 Client IP: 127.0.0.1
    Port: 34562
 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; WOW64; .NET CLR 2.0.50727; .NET CLR 1.1.4322; InfoPath.2; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.590; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; Zune 3.0; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; MS-RTC LM 8)
  ViewState: /wEPDwUKMTc2NzE0NzA0NmRkmWc0SFS8H55FfURfpUekG2KhS8g=
 Referer: https://localhost/MySite/Default3.aspx<br>   Path: /MySite/Default.aspx]

[HttpException (0x80004005): Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that <machineKey> configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.]
   System.Web.UI.ViewStateException.ThrowError(Exception inner, String persistedState, String errorPageMessage, Boolean macValidationError) +106
   System.Web.UI.ViewStateException.ThrowMacValidationError(Exception inner, String persistedState) +14
   System.Web.UI.ObjectStateFormatter.Deserialize(String inputString) +242
   System.Web.UI.ObjectStateFormatter.System.Web.UI.IStateFormatter.Deserialize(String serializedState) +4
   System.Web.UI.Util.DeserializeWithAssert(IStateFormatter formatter, String serializedState) +37
   System.Web.UI.HiddenFieldPageStatePersister.Load() +207
   System.Web.UI.Page.LoadPageStateFromPersistenceMedium() +105
   System.Web.UI.Page.LoadAllState() +43
   System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +6785
   System.Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +242
   System.Web.UI.Page.ProcessRequest() +80
   System.Web.UI.Page.ProcessRequestWithNoAssert(HttpContext context) +21
   System.Web.UI.Page.ProcessRequest(HttpContext context) +49
   ASP.default_aspx.ProcessRequest(HttpContext context) +4
   System.Web.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +181
   System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +75

 

Cause:

This will happen if you have specified an action on the forms element, and if the action is different than the page you are browsing to, i.e. in this case the page I am browsing to is Default3.aspx, but the action is set to Default.aspx (as you can see from the Path and Referer in the error message)

<form id="form1" runat="server" action="Default.aspx">

 

The reason this occurs after installing SP1 for .NET 3.5 is because prior to this service pack, the action attribute was ignored.   Now that it is no longer ignored, the post-back will actually post back to the action page, and of course the view state for Default3.aspx will not be valid for Default.aspx.

You’ve heard it before:)  this is not a bug, it’s a feature…  in this case that’s actually true…

 

Resolution:

Remove the action attribute, or change it to post to the right page if you want to have viewstate enabled.

 

Laters,

Tess

Comments

  • Anonymous
    April 14, 2009
    PingBack from http://microsoft-sharepoint.simplynetdev.com/validation-of-viewstate-mac-failed-after-installing-net-35-sp1/

  • Anonymous
    April 14, 2009
    After installing .NET 3.5 SP1 you may get Validation of viewstate MAC failed exceptions when doing post

  • Anonymous
    April 14, 2009
    With respect solution does not sounds like "solution". what if i want to post data to different page with viewstate enabled..?

  • Anonymous
    April 14, 2009
    Jacob, If you want to move to a different page you would need to redirect or similar in that case and add the data you want to pass in a query string or cookie.     As viewstate is stored in the form (in a hidden form field) and "unpacked" at the beginning of each request, posting viewstate from one page to another will not work.   This has not worked before either, i.e. the action attribute has been ignored so if there was an action on the form field that has never worked.  The only difference now is that the action attribute is honored.     Manual posting (through code) has always given this error, if you post viewstate to another page... This post was meant to explain why you get this exception after installing 3.5 SP1 and what you can do to resolve the exception.  I agree that it is not a solution to "I want to post viewstate between pages".  However that is something that has never worked, by design.     If this is something that is essential to you I would urge you to either send feedback through visual studio (http://msdn.microsoft.com/en-us/library/zzszcehe.aspx)  or to open a support case and make a design change request. HTH, Tess

  • Anonymous
    April 14, 2009
    I don't mean to encourage this (because it disables a security feature), but couldn't you use Page.EnableViewStateMac to disable view state MAC validation to work around this behavior? http://msdn.microsoft.com/en-us/library/system.web.ui.page.enableviewstatemac.aspx

  • Anonymous
    April 14, 2009
    I'm luck, not meet this error yet :)

  • Anonymous
    April 19, 2009
    I'm no web/app developer but after a "this isn't my job, I shouldn't have to deal with this" rant, I found that if you want to keep viewstate enabled and post to a different page, remove the 'action' attribute from the 'form' tag, and  then replace your html 'submit' control with an ASP.net button and set its 'PostBackUrl' property to the page that was previosuly specified in form's 'action' atribute. Hope that I understand the problem correctly and that this helps. Seems less drastic than: enableViewStateMac="false" viewStateEncryptionMode="Never" enableEventValidation="false" ...and so on.

  • Anonymous
    April 21, 2009
    I ran across this problem recently in dealing with MVC and asp.net/AJAX controls. No matter what I did, I could not get rid of the error. Even looking at the postback URL it looked the same as the referring URL. Of cource since I am using RealTime MSCharts, I needed the viewstate. The way I solved this problem, it to put all AJAX controls in an UpdatePanel. For some reason, the UpdatePanel (which posts back a partial view) posts back to the correct URL with the proper viewstate and voila, error gone!!!

  • Anonymous
    April 22, 2009
    Thanks for the post, solved it for me.

  • Anonymous
    April 23, 2009
    this is my solution.  I make a POST form, with the values i want. Private Sub PostResponse()  Dim _msgResponse As String = String.Empty  Dim _fldResponse As String = String.Empty  _fldResponse += Me.getHiddenField("Amount", 1230.45)  _fldResponse += Me.getHiddenField("Currency", 214)  _fldResponse += Me.getHiddenField("AuthCode", "3242424")  _fldResponse += Me.getHiddenField("ReferenceCode", "A453453")  _msgResponse = String.Format("<form name=t id=t action={0} method=post>{1}</form>", URL, _fldResponse)  Response.Clear()  Response.Charset = String.Empty  Response.ContentType = "text/html"  Response.Write(_msgResponse)  Response.Write("<script> t.submit(); </script>")  Response.End() End Sub Private Function getHiddenField(ByVal campo As String, ByVal valor As String) As String  Return String.Format("<input name=""{0}"" type='hidden' value=""{1}"" >", campo, valor) End Function

  • Anonymous
    April 29, 2009
    Would this happen if say i had mypage.aspx and its action were set to mypage.aspx?var= Would the query string cause this to happen? I did have sp1 installed, although this was an .net 2.0 site i also tried unistalling sp1 but still get the error. I have another machine without sp1 on it - code works on there. So i assume the problem is with sp1 - any way to get my server back to the way it was without sp1 on it? Can i reinstall the 2.0 framework to restore it? thanks

  • Anonymous
    April 30, 2009
    I just recently received this error (unable to reproduce however). It popped up from javascript (I am using Ajax/UpdatePanel) rather than the server throwing the error. Any ideas on how that could be caused? I checked my aspx page (only one of them) and the form tag does not have an action attribute. Thanks

  • Anonymous
    April 30, 2009
    I just started noticing this problem. It happens if my web page sits idle for 20 minutes or so and then you click on the menu item. The web site is only a one page aspx file so it's not a file name issue as Tess pointed out.

  • Anonymous
    May 07, 2009
    The comment has been removed

  • Anonymous
    May 24, 2009
    Thanks for this. Accidentally had a form action that wasn't meant to be there and would never have though to checked. Fixed the problem for me.

  • Anonymous
    May 28, 2009
    I would also like to know the answer to Ian's question about the query string. I have started to see this as well since sp1.

  • Anonymous
    May 28, 2009
    not sure why you would want to restore 2.0 rather than just removing the querystring,  the querystring wasn't honored before (nor the rest of the action) so removing it or reverting to 2.0 would have the same effect there

  • Anonymous
    June 02, 2009
    Excellent!!!! For me it is working..

  • Anonymous
    June 18, 2009
    I have a vb 2.0 website and SP1 installed for several months and just recently got there error.  I have not made any modifications to the production version of my website for over 2 weeks, and it is used daily by several departments.  yet the errors just popped up this morning.   The other oddity is that if I just try and re navigates to the same page that threw the error and preform the same actions that caused the error in the first place, it works fine the second time.  There error is erratic and inconsistent which only makes it harder to fix as i am not sure if it is truly working, or if it just happens to work this time.

  • Anonymous
    July 08, 2009
    For me it is a content management system I wrote and on their membership page they have a link to PayPal so essentially I have to form tags and each action goes to a different location (thanks to the paypal code). Any ideas?

  • Anonymous
    July 13, 2009
    Thank you very much indeed. I solved my extremely bad problem by this.

  • Anonymous
    July 15, 2009
    Thank you very much. It worked for me fine.

  • Anonymous
    July 31, 2009
    The comment has been removed

  • Anonymous
    August 02, 2009
    Tess.... You're a Godsend! Thanks very much. Phil

  • Anonymous
    September 04, 2009
    The comment has been removed

  • Anonymous
    September 24, 2009
    I am using asp.net mvc frame work and dundas charts. When I click on the "save" command button in the chart I got the "Validation of viewstate MAC failed" error. I have removed the action attribute from form and also make the viewstate diabled. Still I got the error. Please note this error is occuring in windows 2008 server ann IIS 7.0. In win xp and IIS 6, it is working fine. Anybody with same issues? please share ur fix.

  • Anonymous
    September 25, 2009
    We installed .Net 3.5 and had a similar issue.  We get: <form name="form1" method="post" action="&lt;%= LocalURL %>XMLLogin.aspx Whereas before we got: <form name="form1" method="post" action="xmlLogin.aspx My question is, after we uninstalled .Net 3.5 we still get the same behaviour?  Does .Net 3.5. make some permanent changes?  Can I reverse these for now on my affected servers?

  • Anonymous
    September 30, 2009
    I have gotten this error when loading pages on a .NET 1.1 asp.net application that was incorrectly configured in IIS as to use the .NET 2.0 framework. Much of the site runs fine, but some pages would return this error. Changing the setting on the vdir/web app in IIS back to 1.1 resolved the issue.

  • Anonymous
    October 31, 2009
    Excellent! For me it is working.. Thanks! Thanks! Thanks!

  • Anonymous
    December 08, 2009
    I am facing the same problem Can server.transfer also cause this problem?

  • Anonymous
    January 05, 2010
    Thank you! Worked perfectly in my case.

  • Anonymous
    January 05, 2010
    Excellent soultion. Searched far and wide and tried many other solutions. This finally worked. Thanks.

  • Anonymous
    January 10, 2010
    Im getting the same error but my form tag does not have an action, i have written the code in VB with 'response.redirect("Default.aspx")' at the end of the actions i require.

  • Anonymous
    March 18, 2010
    Hi Tess, Since you seem to solve stuff,.. perhaps you should look at: http://forums.asp.net/t/955145.aspx And, http://connect.microsoft.com/VisualStudio/feedback/details/101988/validation-of-viewstate-mac-failed-when-posting-too-quickly Seems there is a much bigger problem that is still not fixed.

  • Anonymous
    March 18, 2010
    Paul, The problem occurs because the hidden fields at the bottom of the page are not posted when the user clicks before the page finishes rendering.  The suggestion at the bottom of the connect bug (disabling postbacks before the page is fully rendered) should work.    I also posted about this issue a while back here http://blogs.msdn.com/tess/archive/2008/03/17/asp-net-viewstate-error-validation-of-viewstate-mac-failed.aspx and there is a link in there to a more comprehensive post by my colleague Tom on the topic HTH Tess

  • Anonymous
    March 23, 2010
    Tess, I never would have thought of checking this (I didn't write the pages that broke after the upgrade), but it makes perfect sense. Thanks!

  • Anonymous
    March 24, 2010
    Hi, I have just implemented the code that 'Javier Sanchez' suggested, and that worked fine for me. Thanks. Duane.

  • Anonymous
    March 26, 2010
    Seems like I have the same issue howie has. I basically have a search form with a few ddls and txt boxes and a button to submit. I have a bunch of pages but only the master page for all of those has the form tag. When letting the session time out then clicking the button the server throws an error:   System.Web.HttpException: Validation of viewstate MAC failed..... Not sure why you hadn't replied to howie on his post. Maybe it has to do with having the form tag in the master page??

  • Anonymous
    March 28, 2010
    Nate,  I've been in and out of the office so howies comment probably came in some time when i was out of the office... With a 20 min delay many things could happen, it could be a session timeout (even though i dont think that that should cause this) but 20 mins is also the standard idle time in the health monitoring settings, so if the process is idle for 20 mins it will recycle (unless you have changed this)... That recycle might be causing this if something changes at a recycle...  Not sure what it would be off hand though... but might be worthwhile testing removing that setting.

  • Anonymous
    April 17, 2010
    you are a gift from Allah... thank you very very very much...you solved my catastrophic problem...

  • Anonymous
    May 02, 2010
    simple but effective solution to copy paste code ;)

  • Anonymous
    May 25, 2010
    My application is developed using framework 2.0. It was working perfectly fine, but after installing Windows Updates (.net framework 3.5 was included in these updates), my application stopped working. Removing the action attribute worked for me. Thanks a lot

  • Anonymous
    September 22, 2010
    The reason for this error is validation of Viewstate failing because of different value of key for encryption/decryption across different server on farm. Below link provide good explanation of this error and possible resolution for the same. a2zmenu.com/.../Validation-of-viewstate-MAC-failed.aspx

  • Anonymous
    October 31, 2011
    This is very helpful thanks! Thanks a lot!