Viewstate timeout error

Question

I develop mostly for desktop so, I tend to think as WebForms as a web equivalent of WinForms. Unfortunetly this is not true.

Recently I have discovered that the Viewstate have some kind of timeout.

My problem is similar as I have read in most questions, in particular here (in my case is only around 5 to 10 minutes).

Here Microsoft says that one solution for this problem is:

 <asp:Page EnableViewStateMac="False" />

However as we can read further they say:

Security Note:
This attribute should never be set to false in a production Web site, 
even if the application or page does not use view state. 
The view state MAC helps ensure the security of other ASP.NET functions 
in addition to view state.

For this reason I don't want to set EnableViewStateMac to false and I have no access to my server (is shared hosting).

My question is: can we store the Viewstate between postbacks even if our page stay idle for a long time? If yes, how?

Thank you

Answer 1

The viewstate is encrypted using a machine key to ensure that it is not tampered with during postback. The machine key used to encrypt the viewstate is by default auto-generated and if the time out happens then the key's decryption will fail because the machinekey will get regenerated.

The machinekey is by default available at machine level config file.

<machineKey validationKey="AutoGenerate,IsolateApps"  
            decryptionKey="AutoGenerate,IsolateApps" 
            validation="SHA1" decryption="Auto" />

To fix this, you can use your own defined machine key. You can generate using online tools as well, like this or through IIS.

How to add this machinekey to web.config can be read at MSDN.

It should be placed under the system.web section, like this -

<configuration>
  <system.web>
    <machineKey decryptionKey="Decryption key goes here,IsolateApps" 
                validationKey="Validation key goes here,IsolateApps" />
  </system.web>
</configuration>