ASP.NET Viewstate error – Validation of viewstate MAC failed

Last week I was working with on a case where they were getting this error message

HttpException (0x80004005): Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster

Typically this occurrs if the application is on a webfarm and autogenerate is used as the validation key.  This is because if you request a page and click a button for example, the postback may go to another server in the web farm and if the validation keys don't match, will consider the viewstate as invalid.

However, in this case, they were not on a web farm so none of this applied.  

Viewstate and viewstate validation use a couple of hidden form fields like __VIEWSTATE and __EVENTVALIDATION.  If the page renders so slowly that the __EVENTVALIDATION field has not rendered by the time someone clicks the button or control that causes the postback, ASP.NET will also believe that the viewstate is invalid and report this.  

I had gotten this far and in my case I also knew that the viewstate used was very large which of course causes the page to take longer to render so I asked them to reduce the viewstate as much as possible and review the page to determine why it took so long to render.  

I still recommend this, but this weekend I also read this article from my colleague Tom that gives more details along with some solutions for the issue and I thought I'd share it with you in case you don't subscribe to his blog.    




Comments (11)

  1. Jesse says:

    Aha! I think that’s exactly the problem I’m having with a produciton web application I maintain. Thanks so much.

  2. Joshua says:

    Just thought that I’d point out, that while writing my own blogging software (which, sadly is offline, due to a memory leak (I think) that would take down the server every 12 hours or so – haven’t had time to look into it yet) I encountered this a lot with comment spamming bots. They try and post to the page directly with what they pulled earlier, which included a viewstate.

    Of course, trying later caused the viewstate to be invalid. It got so bad, that after I implemented an email function into the global.asax file for handling and reporting errors did I notice that it was averaging about 500+ a day. And my blog was by no means popular.

    On the flip side, it was interesting to see the bots that could load the page, grab a valid viewstate, and manage a successful post (which I was developing anti spam/keyword filtering on). On those, I averaged about 2 to 3 a day.

  3. Tess says:

    very interesting…

    I think in your case though you are probably running into this which is very similar (in fact same error message) but different cause…

    I know what you’re saying about the spammers, I easily also get around 500 a day which is a bit sad because I have had to turn on comment moderation for a while to avoid getting publishing the spam comments since most of the time they are highly offensive.   Lately they have also tried sending captcha text which is a bit ironic given that the blog doesnt use captcha but I guess they send out the same to all

    Community server seems to catch most of the spam comments though these days, so I am leaning more and more towards turning off comment moderation…    

  4. Tess's If broken it is, fix it you should blog is always good for a read. Tess is an escalation engineer

  5. Craig says:

    I saw the same problem on an aspx page with a gridview.  All it was was a web tracker js file, at the bottom of the page, that was not getting downloaded.  I commented out the tracker and all was well.

    I can’t decide if that’s a bug in IE, the Framework, or the whole concept of ASP.Net!

  6. mike says:

    Validation of viewstate MAC failed

    Update: In my case I was NOT using gridview nor DataKeyNames nor slow loading page.

    Small page with on two buttons, two text boxex, and dropdownlist. Clicking the button1 (add) caused the above error every time.

    Problem turned out to be the form action property was pointing to  a non-existent page! I used a code-behind method when the Add button is clicked and do not use form.submit. When I cleared the action property of the form, problem went away.

    My "guess" is that the form submit happens before

    the code-behind code is processed, since even in debug I would get the error before the breakpoint was hit.

    Hope this leads to the final answer to this.



  7. Dave says:

    this worked for me.

    <pages validateRequest="false" enableEventValidation="false" viewStateEncryptionMode ="Never" />

  8. Shane says:

    Mike, you saved me!

    I had tried every solution I could find for this problem, it turns out just the action property of my form tag was wrong.  Thank you very much!

  9. GSingh says:


    i do all the things you

    mention in your post and disable the view and event state at application level in web.config, but still getting the same error but at a very low rate then previous one. Do smhtin 😉

  10. Angela S says:

    I notice that it happens when IIS recycles the web application and user has been idle

  11. Jitendra Bisht says:

    Facing the same proble even writing the code in web.config

      <pages enableViewStateMac ="false" enableEventValidation ="false " viewStateEncryptionMode ="Never"></pages>

    Server Error in '/StateManagement' Application.

    Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that <machineKey> configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.

    Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

    Exception Details: System.Web.HttpException: Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that <machineKey> configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.

    Source Error:

    The source code that generated this unhandled exception can only be shown when compiled in debug mode. To enable this, please follow one of the below steps, then request the URL:

    1. Add a "Debug=true" directive at the top of the file that generated the error. Example:

     <%@ Page Language="C#" Debug="true" %>


    2) Add the following section to the configuration file of your application:



          <compilation debug="true"/>



    Note that this second technique will cause all files within a given application to be compiled in debug mode. The first technique will cause only that particular file to be compiled in debug mode.

    Important: Running applications in debug mode does incur a memory/performance overhead. You should make sure that an application has debugging disabled before deploying

Skip to main content