“Invalid postback or callback argument” in ASP.NET

I saw this error twice recently, but as often happens for two completely different cases so here they are, hope it helps someone to same their time…

Invalid postback or callback argument. Event validation is enabled using <pages enableEventValidation="true"/> in configuration or <%@ Page EnableEventValidation="true" %> in a page. For security purposes, this feature verifies that arguments to postback or callback events originate from the server control that originally rendered them. If the data is valid and expected, use the ClientScriptManager.RegisterForEventValidation method in order to register the postback or callback data for validation

Nested forms

The first problematic application was dynamically building page layout and manipulating the HTML stream sent to the client; in my specific case there was some manipulation carried on the client through Javascript, but I think the same may happen if for example the HTML stream is changed through an HttpHandler after the main ASP.NET processing has been completed. The page was rendered correctly within the browser, but a postback thrown the exception above and this was due to a malformed page structure, where we had nested <form> tags like in the following example:

    <form id="form1" runat="server">
            <asp:Button ID="Button1" runat="server" Text="Button" />

There was a bug in the page, so the solution is to fix it to avoid the nested <fom> tags.

Hidden postback control

Here we had a DataGrid and on the ItemCreated event the customer was calling Item.Attributes.Add() to add a call to __DoPostBack() and have an automatic postback when a record was selected; needless to say, the postback attempt returned the error at the beginning of the post.

The customer had defined a “Select” column with a button to actually select the row within the DataGrid and set the Visible property of this button to false; ASP.NET renders the button to select the record as a LinkButton. This also emits the __DoPostBack() javascript method and registers it for event validation calling ClientScript.RegisterForEventValidation(); as you can imagine, if the control is not visible (i.e. Visible=”false”) the control is not rendered and therefore is not registered for event validation. But the DataGrid uses that event anyway, which ultimately throws the error.

The solution in this case is to manually register each row for event validation with code similar to the following:

protected override void Render(HtmlTextWriter writer) 
    foreach (DataGridItem row in DataGrid1.Items) 
    ClientScript.RegisterForEventValidation(row.UniqueID.ToString() + ":_ctl0"); 

The event validation must be registered within the Render() method of the page.

Also note that there could be different degrees of added complexity to this scenario: for example if the name of the control causing the postback is built dynamically and maybe the application has been migrated from ASP.NET 1.1 to 2.0, you have to be aware that the naming convention for dynamic controls has changed. ASP.NET 1.1 uses DataGrid1$_ctl2$_ctl0 while ASP.NET 2.0 uses DataGrid1$ctl02$ctl00. It is possible to control this behavior setting xhtmlConformance=”Legacy” (see xhtmlConformance); however note that reverting back to Legacy mode causes ASP.NET 2.0 to use a column (“:”) sign in control names for event validation, instead of the dollar sign (“$”) which uses for rendering.



Quote of the day:

Read, every day, something no one else is reading. Think, every day, something no one else is thinking. Do, every day, something no one else would be silly enough to do. It is bad for the mind to be always part of unanimity. – Christopher Morley

Comments (21)

  1. krg says:

    Good morning.

    I’ve been tracking the thread about this issue on the ASP.NET forums (http://forums.asp.net/t/922994.aspx) and have tried a bunch of things, but I haven’t found a good solution to my problem.

    The VeriSign seal JavaScript introduces its own <form> element which intermittently (I’ve never been able to hold my teeth just right to reliably reproduce it) produces this error.

    How can I go about registering an externally-referenced script with a <form> for event validation?


  2. Erick says:

    This error also happens alot when the page is posted back before the __EventValidation hidden field is fully sent to the client. (which happens frequently since it gets rendered at the end of the page instead of the beginning like viewstate etc).  And often times the only real fix is to disable event validation completly.

    To be perfectly honest, I think this is fairly serious problem with the WebForms model.   I like the fact that MS is taking the "Secure by default" approach here, but this particular feature doesn’t translate to the www very well.   It gets even worse as more and more processing is being moved to the client.  

    I guess the goal is to make sure that only valid values are submitted from the client, which is a good thing, but the way it is implemented is by having the client tell the server  what the valid values coming from the client are, and all someone has to do to get around this and submit a malicious value is to manually modify __EventValidation. (of course that is easier said that done, considering it is encrypted and all of that, but its still a pretty flacky design).

    I am not really sure what the solution is, the web is stateless and thats why we have to implement things like viewstate and eventvalidation on the client side.

    My company has a blanket policy that all sites we develop have eventvalidation disabled.  Even on a highly optimized page with the smallest html footprint we can get, there are still EventValidation exceptions coming from clients on slow connections.  The only way to deal with that is to disable eventvalidation and just be really careful about checking values on the server side to make sure they are legal.  And considering it is theoretically possible to bypass eventvalidation by cracking the hidden field, this is something we need to do anyways.

    Just my two cents, but i think that feature is poorly implement, and causes way to many problems.

  3. Edddy says:

    Erick: It seems that you explain why I’m getting this error from time to time, but I will not turn off  EventValidation, it is the first line of defense against cross site scripting attacks.

  4. jct says:

    THANK YOU for the info that this error can be caused by having multiple form tags…didn’t see that mentioned anywhere else I googled for "Invalid postback.." error. I can now get back to work.

    Something else I noticed is that a postback generated from within the nested form seemed to work fine; interestingly, postbacks generated from outside the nested forms are the only ones that crapped out.

    thanks again

  5. David says:

    Thanks for this info. It helped me figure out where the problem was.

    My page was loading a java applet that needed to use a different cab file depending on whether or not it is a Mac and this is done using javascript to add the applet tag to the page. There is also a refresh button rendered to the page, so that users can re-initialised the applet when they need to. Whenever the page was being a bit slow, users would hit the refresh button thinking that the page hadn’t loaded properly. It seems that because it was in the process of loading and javascript was adding html on the fly, the hidden eventvalidation field had not been loaded at the point of clicking refresh so was missing when the server recieved the request and produced this error. I can live without event validation on this page.

    On another note, it seems odd that this field would be added to the end of the form rather than the top where the eventtarget, eventarguments and viewstate are rendered. If it were rendered to the top of the form, then the situation that I had would not have occurred.

    Again thanks for the post, it was a great help.

  6. Jason says:

    I found that this error occurred when I had a repeater and I bound (binded?) it twice.

  7. Alex says:

    I also found the double binding was causing this error – exiting the Page load on postback fixed the problem

  8. Dhanraj Agrawal says:


    Please note the evidence of this issue:

    You will find that this error will come oftenly, and we will find that this error mainly comes after every 20 minutes by default.

    Please can you confirm back.

  9. Dhanraj, the error appears when you post the page back, no specific timeout that I am aware of… maybe you are referring to a different issue?

  10. hi..... same error says:


    i m also faced the same error…  my problem is … i have dropdown,and button in the grid view…

    in dropdown i chage the status and i save by clicking button in the grid.. after the operation grid will bind to show the updated information…

    in this binding onlt i m getting error…

    how can i solve it … vellore.balaji@gmail.com

  11. Jay Foster says:

    There’s a hidden caveat with this error that took me a while to figure out. In my case, I had dynamic template columns in a gridview, all controls dynamically created. One of the template controls was a button and the other was a dropdown list. The dropdown list had an event wired up and a postback. Everything was working, however when I clicked the back button, and then the template button, I would get the error. As it turned out my code was fine. The back button does not invoke the page_load so I couldn’t recreate my controls and therefore, due to the postback (on the ddl) my page did not look the same as the previously recreated page and threw the error. The answer: <%@ OutputCache Location="None" %>. This ‘expires’ the page so that the user must hit the refresh button. There might be other solutions but once you create and recreate the controls properly, look at how the page can be seen without the page_load event (like the back button)

  12. Mick says:

    THANK YOU for this post on "Invalid postback or callback argument" errors.  I too didn’t see the Nested <form> tags cause mentioned anywhere else.   It seems that my error was the result of an outdated Google search box I was using prior to moving to ASP.Net.

    BTW, it does not happen running locally using VWD, only with remote host.  Also I agree from the earlier comment that a postback generated from within the nested form seemed to work fine – in my case the search action.

    Thanks again! 🙂

  13. JAMC says:

    I struggled with this problem for days, but with much experimentation have managed to sort my problem out. As the number of potential causes for this error seems quite high, I don’t know whether this will help anyone, but here goes…

    1. Check whether you’re using a Page.Validate call.

    2. More importantly check the positioning of the Page.Validate call in your code execution sequence. I had placed my Validate call too late in the code execution – i.e. I was making changes between the Page_Load and Page_PreRender events that the Page.Validate call did not like. Place the Page.Validate call as early as possible, so that the call is validating the original data sent by the postback, not the data you’ve altered after the postback.

  14. Sid says:

    Thanks for this post. Helped a lot !

  15. Vivek says:

    Just add this to your web config and make pages..like ErrorPage.aspx , and see you will control this error by making your custom control error.


    <customErrors defaultRedirect="ErrorPage.aspx" mode="On">       <error statusCode="500" redirect="servererror.aspx" />    <error statusCode="404" redirect="filenotfound.aspx" />    <error statusCode="403" redirect="AccessDenied.aspx" /> </customErrors>


  16. Ramprasad says:

    Oh dear… you saved me a lot…..lot…. of time..

    Thank you very much.

  17. Adam says:

    I know I am a year behind you all but this has just made my day. Thank you from a happy english developer.

  18. Eric says:

    This was happening to me because I was loading a dynamic DropDownList with an invalid value.

    I had the AJAX CascadingDropDown extender on a couple of dynamically created DropDownLists, where a selection in one would populate the other.  The default value in the first would generate a list in the child which didn’t contain the default value I was assigning it … poof … validation problem on all postbacks.

  19. Pete says:

    I’m currently fighting with this error and cannot reproduce it reliably on my development machine.  It seems to happen sporadically once installed on a customer’s server.  This page has given me food for thought, but I’m thinking about turning page validation off.  Other web development languages do not have this facility builtin as standard (Java, PHP, etc) to my knowledge, not when I worked with them, it’s up to the developer to ensure the returned data is correct.

    A bug has never driven me up the wall as much as this one.

  20. Pete, have you considered calling our Support to seek assistance? This error, as every error can have a lot of different underlying causes, influenced by different configurations and environments… Reading your comment my feeling is that there is need to have a close look at the specific page on this specific server, there is not general advice always available.

    I would not turn input validation off, your right that is developer’s responsability to ensure returned data is correct, but if the server can help, why not? I would not give up security layers unless absolutely forced to.