Validation of viewstate MAC failed after installing .NET 3.5 SP1


After installing .NET 3.5 SP1 you may get Validation of viewstate MAC failed exceptions when doing post backs on ASP.NET pages

Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that <machineKey> configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.

Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.
Exception Details: System.Web.HttpException: Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that <machineKey> configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.

Stack Trace:

[HttpException (0x80004005): Unable to validate data.]
   System.Web.Configuration.MachineKeySection.GetDecodedData(Byte[] buf, Byte[] modifier, Int32 start, Int32 length, Int32& dataLength) +289
   System.Web.UI.ObjectStateFormatter.Deserialize(String inputString) +140

[ViewStateException: Invalid viewstate. 
	Client IP: 127.0.0.1
	Port: 34562
	User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; WOW64; .NET CLR 2.0.50727; .NET CLR 1.1.4322; InfoPath.2; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.590; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; Zune 3.0; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; MS-RTC LM 8)
	ViewState: /wEPDwUKMTc2NzE0NzA0NmRkmWc0SFS8H55FfURfpUekG2KhS8g=
	Referer: http://localhost/MySite/Default3.aspx
	Path: /MySite/Default.aspx]

[HttpException (0x80004005): Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that <machineKey> configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.]
   System.Web.UI.ViewStateException.ThrowError(Exception inner, String persistedState, String errorPageMessage, Boolean macValidationError) +106
   System.Web.UI.ViewStateException.ThrowMacValidationError(Exception inner, String persistedState) +14
   System.Web.UI.ObjectStateFormatter.Deserialize(String inputString) +242
   System.Web.UI.ObjectStateFormatter.System.Web.UI.IStateFormatter.Deserialize(String serializedState) +4
   System.Web.UI.Util.DeserializeWithAssert(IStateFormatter formatter, String serializedState) +37
   System.Web.UI.HiddenFieldPageStatePersister.Load() +207
   System.Web.UI.Page.LoadPageStateFromPersistenceMedium() +105
   System.Web.UI.Page.LoadAllState() +43
   System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +6785
   System.Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +242
   System.Web.UI.Page.ProcessRequest() +80
   System.Web.UI.Page.ProcessRequestWithNoAssert(HttpContext context) +21
   System.Web.UI.Page.ProcessRequest(HttpContext context) +49
   ASP.default_aspx.ProcessRequest(HttpContext context) +4
   System.Web.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +181
   System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +75

 

Cause:

This will happen if you have specified an action on the forms element, and if the action is different than the page you are browsing to, i.e. in this case the page I am browsing to is Default3.aspx, but the action is set to Default.aspx (as you can see from the Path and Referer in the error message)

<form id="form1" runat="server" action="Default.aspx">

 

The reason this occurs after installing SP1 for .NET 3.5 is because prior to this service pack, the action attribute was ignored.   Now that it is no longer ignored, the post-back will actually post back to the action page, and of course the view state for Default3.aspx will not be valid for Default.aspx.

You’ve heard it before:)  this is not a bug, it’s a feature…  in this case that’s actually true…

 

Resolution:

Remove the action attribute, or change it to post to the right page if you want to have viewstate enabled.

 

Laters,

Tess

Comments (44)

  1. What's New says:

    After installing .NET 3.5 SP1 you may get Validation of viewstate MAC failed exceptions when doing post

  2. Jacob Mir says:

    With respect solution does not sounds like "solution". what if i want to post data to different page with viewstate enabled..?

  3. Tess says:

    Jacob,

    If you want to move to a different page you would need to redirect or similar in that case and add the data you want to pass in a query string or cookie.    

    As viewstate is stored in the form (in a hidden form field) and "unpacked" at the beginning of each request, posting viewstate from one page to another will not work.  

    This has not worked before either, i.e. the action attribute has been ignored so if there was an action on the form field that has never worked.  The only difference now is that the action attribute is honored.    

    Manual posting (through code) has always given this error, if you post viewstate to another page…

    This post was meant to explain why you get this exception after installing 3.5 SP1 and what you can do to resolve the exception.  I agree that it is not a solution to "I want to post viewstate between pages".  However that is something that has never worked, by design.    

    If this is something that is essential to you I would urge you to either send feedback through visual studio (http://msdn.microsoft.com/en-us/library/zzszcehe.aspx)  or to open a support case and make a design change request.

    HTH,

    Tess

  4. Joe Chung says:

    I don’t mean to encourage this (because it disables a security feature), but couldn’t you use Page.EnableViewStateMac to disable view state MAC validation to work around this behavior?

    http://msdn.microsoft.com/en-us/library/system.web.ui.page.enableviewstatemac.aspx

  5. Jack says:

    I’m luck, not meet this error yet 🙂

  6. Sharky says:

    I’m no web/app developer but after a "this isn’t my job, I shouldn’t have to deal with this" rant, I found that if you want to keep viewstate enabled and post to a different page, remove the ‘action’ attribute from the ‘form’ tag, and  then replace your html ‘submit’ control with an ASP.net button and set its ‘PostBackUrl’ property to the page that was previosuly specified in form’s ‘action’ atribute.

    Hope that I understand the problem correctly and that this helps. Seems less drastic than: enableViewStateMac="false" viewStateEncryptionMode="Never" enableEventValidation="false"

    …and so on.

  7. tweek says:

    I ran across this problem recently in dealing with MVC and asp.net/AJAX controls. No matter what I did, I could not get rid of the error. Even looking at the postback URL it looked the same as the referring URL. Of cource since I am using RealTime MSCharts, I needed the viewstate.

    The way I solved this problem, it to put all AJAX controls in an UpdatePanel. For some reason, the UpdatePanel (which posts back a partial view) posts back to the correct URL with the proper viewstate and voila, error gone!!!

  8. Beth says:

    Thanks for the post, solved it for me.

  9. Javier Sanchez says:

    this is my solution.  I make a POST form, with the values i want.

    Private Sub PostResponse()

     Dim _msgResponse As String = String.Empty

     Dim _fldResponse As String = String.Empty

     _fldResponse += Me.getHiddenField("Amount", 1230.45)

     _fldResponse += Me.getHiddenField("Currency", 214)

     _fldResponse += Me.getHiddenField("AuthCode", "3242424")

     _fldResponse += Me.getHiddenField("ReferenceCode", "A453453")

     _msgResponse = String.Format("<form name=t id=t action={0} method=post>{1}</form>", URL, _fldResponse)

     Response.Clear()

     Response.Charset = String.Empty

     Response.ContentType = "text/html"

     Response.Write(_msgResponse)

     Response.Write("<script> t.submit(); </script>")

     Response.End()

    End Sub

    Private Function getHiddenField(ByVal campo As String, ByVal valor As String) As String

     Return String.Format("<input name=""{0}"" type=’hidden’ value=""{1}"" >", campo, valor)

    End Function

  10. Ian says:

    Would this happen if say i had mypage.aspx and its action were set to mypage.aspx?var=

    Would the query string cause this to happen? I did have sp1 installed, although this was an .net 2.0 site

    i also tried unistalling sp1 but still get the error.

    I have another machine without sp1 on it – code works on there. So i assume the problem is with sp1 – any way to get my server back to the way it was without sp1 on it? Can i reinstall the 2.0 framework to restore it?

    thanks

  11. christopher says:

    I just recently received this error (unable to reproduce however). It popped up from javascript (I am using Ajax/UpdatePanel) rather than the server throwing the error. Any ideas on how that could be caused? I checked my aspx page (only one of them) and the form tag does not have an action attribute.

    Thanks

  12. howie says:

    I just started noticing this problem. It happens if my web page sits idle for 20 minutes or so and then you click on the menu item. The web site is only a one page aspx file so it’s not a file name issue as Tess pointed out.

  13. Ferozkhan says:

    When i tried to integrate Google search box with asp.net 2.0 page, but service pack sp1 with 3.0 have installed in my  system, i am getting Validation of viewstate MAC failed error.

    plz advice to resolve the issues.

  14. Brad Wilson says:

    Thanks for this. Accidentally had a form action that wasn’t meant to be there and would never have though to checked.

    Fixed the problem for me.

  15. James says:

    I would also like to know the answer to Ian’s question about the query string. I have started to see this as well since sp1.

  16. Tess says:

    not sure why you would want to restore 2.0 rather than just removing the querystring,  the querystring wasn’t honored before (nor the rest of the action) so removing it or reverting to 2.0 would have the same effect there

  17. Jaicky Crusoe says:

    Excellent!!!!

    For me it is working..

  18. jboschetto says:

    I have a vb 2.0 website and SP1 installed for several months and just recently got there error.  I have not made any modifications to the production version of my website for over 2 weeks, and it is used daily by several departments.  yet the errors just popped up this morning.   The other oddity is that if I just try and re navigates to the same page that threw the error and preform the same actions that caused the error in the first place, it works fine the second time.  There error is erratic and inconsistent which only makes it harder to fix as i am not sure if it is truly working, or if it just happens to work this time.

  19. Jeff says:

    For me it is a content management system I wrote and on their membership page they have a link to PayPal so essentially I have to form tags and each action goes to a different location (thanks to the paypal code). Any ideas?

  20. Latif OZTURK says:

    Thank you very much indeed. I solved my extremely bad problem by this.

  21. Mit says:

    Thank you very much. It worked for me fine.

  22. Rick Herrick says:

    I tracked the cause of this error down in my Web app to the use of the default page.  So if I go to:

    http://server/MyWebApp/

    This loads Default.aspx, right?  That’s good, but then when I click on one of the link buttons on my sidebar, I get this "Validation of viewstate MAC failed…" error.  Why?  Because the action doesn’t match the app path:

    [ViewStateException: Invalid viewstate.

    Client IP: 127.0.0.1

    ViewState: /snip=

    Referer: http://localhost/MyWebApp/

    Path: /MyWebApp/default.aspx]

    Notice the disjuncture between / and /default.aspx.  I’m certain this is the issue, because if I go straight to http://server/MyWebApp/Default.aspx, everything works properly.

    I fixed this simply by setting EnableViewState="false" on the aspx page in question.  This worked in spite of the fact that the form tag is actually on my master page.  It also worked because I don’t have anything functional on my Default.aspx page other than a stack of link buttons, so if you have a very active form on your Default.aspx, this might be a problem.  Otherwise it’s a pretty simple solution.  All of my other folders and pages use explicit naming, so there are no issues with lack of view state there.

    Hope this helps someone else resolve this issue as well!

  23. Phil says:

    Tess….

    You’re a Godsend! Thanks very much.

    Phil

  24. I just removed the action from the pages, and thanks god it works.

    Thanks very much

  25. saravana c m says:

    I am using asp.net mvc frame work and dundas charts. When I click on the "save" command button in the chart I got the "Validation of viewstate MAC failed" error.

    I have removed the action attribute from form and also make the viewstate diabled. Still I got the error. Please note this error is occuring in windows 2008 server ann IIS 7.0. In win xp and IIS 6, it is working fine.

    Anybody with same issues? please share ur fix.

  26. Jeff B. says:

    We installed .Net 3.5 and had a similar issue.  We get:

    <form name="form1" method="post" action="&lt;%= LocalURL %>XMLLogin.aspx

    Whereas before we got:

    <form name="form1" method="post" action="xmlLogin.aspx

    My question is, after we uninstalled .Net 3.5 we still get the same behaviour?  Does .Net 3.5. make some permanent changes?  Can I reverse these for now on my affected servers?

  27. MikeB says:

    I have gotten this error when loading pages on a .NET 1.1 asp.net application that was incorrectly configured in IIS as to use the .NET 2.0 framework. Much of the site runs fine, but some pages would return this error. Changing the setting on the vdir/web app in IIS back to 1.1 resolved the issue.

  28. Ali says:

    Excellent!

    For me it is working..

    Thanks!

    Thanks!

    Thanks!

  29. Bhanu says:

    I am facing the same problem

    Can server.transfer also cause this problem?

  30. Thank you! Worked perfectly in my case.

  31. Pro Grammer says:

    Excellent soultion. Searched far and wide and tried many other solutions. This finally worked.

    Thanks.

  32. Steve says:

    Im getting the same error but my form tag does not have an action, i have written the code in VB with ‘response.redirect("Default.aspx")’ at the end of the actions i require.

  33. Paul says:

    Hi Tess,

    Since you seem to solve stuff,.. perhaps you should look at:

    http://forums.asp.net/t/955145.aspx

    And,

    http://connect.microsoft.com/VisualStudio/feedback/details/101988/validation-of-viewstate-mac-failed-when-posting-too-quickly

    Seems there is a much bigger problem that is still not fixed.

  34. Tess says:

    Paul,

    The problem occurs because the hidden fields at the bottom of the page are not posted when the user clicks before the page finishes rendering.  The suggestion at the bottom of the connect bug (disabling postbacks before the page is fully rendered) should work.    I also posted about this issue a while back here

    http://blogs.msdn.com/tess/archive/2008/03/17/asp-net-viewstate-error-validation-of-viewstate-mac-failed.aspx

    and there is a link in there to a more comprehensive post by my colleague Tom on the topic

    HTH

    Tess

  35. Dave says:

    Tess,

    I never would have thought of checking this (I didn’t write the pages that broke after the upgrade), but it makes perfect sense.

    Thanks!

  36. Hi,

    I have just implemented the code that ‘Javier Sanchez’ suggested, and that worked fine for me.

    Thanks.

    Duane.

  37. Nate says:

    Seems like I have the same issue howie has.

    I basically have a search form with a few ddls and txt boxes and a button to submit. I have a bunch of pages but only the master page for all of those has the form tag. When letting the session time out then clicking the button the server throws an error:   System.Web.HttpException: Validation of viewstate MAC failed…..

    Not sure why you hadn’t replied to howie on his post. Maybe it has to do with having the form tag in the master page??

  38. Tess says:

    Nate,  I’ve been in and out of the office so howies comment probably came in some time when i was out of the office…

    With a 20 min delay many things could happen, it could be a session timeout (even though i dont think that that should cause this) but 20 mins is also the standard idle time in the health monitoring settings, so if the process is idle for 20 mins it will recycle (unless you have changed this)… That recycle might be causing this if something changes at a recycle…  Not sure what it would be off hand though… but might be worthwhile testing removing that setting.

  39. Ahmad OTHMAN says:

    you are a gift from Allah…

    thank you very very very much…you solved my catastrophic problem…

  40. Apoorva says:

    simple but effective solution to copy paste code 😉

  41. amrit says:

    My application is developed using framework 2.0. It was working perfectly fine, but after installing Windows Updates (.net framework 3.5 was included in these updates), my application stopped working.

    Removing the action attribute worked for me.

    Thanks a lot

  42. Experts Comment says:

    The reason for this error is validation of Viewstate failing because of different value of key for encryption/decryption across different server on farm. Below link provide good explanation of this error and possible resolution for the same.

    a2zmenu.com/…/Validation-of-viewstate-MAC-failed.aspx

  43. Keith says:

    This is very helpful thanks! Thanks a lot!