Should I ignore the occasional Invalid viewstate e

Question

Every now and then (once every day or so) we're seeing the following types of errors in our logs for an ASP.NET 3.5 application

• Invalid viewstate
• Invalid postback or callback argument

Are these something that "just happens" from time-to-time with an ASP.NET application? Would anyone recommend we spend a lot of time trying to diagnose what's causing the issues?

Answer 1

invalid view state don't have any value for your logger or for users or for your website,End users never sees those errors. to avoid this error try to add the following In Global.ascx:

void Application_Error(object sender, EventArgs e)
    {          
                if (ex is HttpException && ex.InnerException is ViewStateException)
                {
                    Response.Redirect(Request.Url.AbsoluteUri);
                    return;
                }
    }

for more info check the following link:

https://www.karpach.com/viewstateexception-invalid-viewstate.htm

Answer 2

I had this kind of exception being thrown in my logs and had a very different cause from the others listed here. I did have a very large ViewState, which is part of the problem. But that was combining with another issue to cause these exceptions (and possibly occasional bad responses from IIS).

The code base I'm working on has some fancy code to avoid double clicks, and as part of that it adds some stuff to the javascript of every button's click event that disables the button after the first click, and then does the usual postback. But calling the postback like that was a problem because some of my buttons already had a postback call generated by .NET automatically. So I was ending up with double postbacks, one of which had an invalid ViewState. Removing the extra postback stopped the exceptions for me.

I know I should really be drastically decreasing the size of the ViewState, but this is a large legacy code base and a change like that would be very invasive.

Answer 3

Well it depends. Invalid viewstate can happen for a variety of reasons.

1. Viewstate is too big and has not finished rendering before a user causes a postback on the page. The fix is generally to disable all controls that trigger postbacks and enable them client side once the page has finished loading - see http://blogs.msdn.com/tom/archive/2008/03/14/validation-of-viewstate-mac-failed-error.aspx
2. You are using viewstate MACs (and you should be, for security reasons) but you have not set a machine key and the application pool has recycled generating a new one. Don't forget to set a ViewStateUserKey.
3. Someone is using an old version of IE on the mac where it truncates hidden form fields. In this case you'll need to move viewstate out of the page into session state.
4. Viewstate MAC issues generally indicate you're on a web farm and have forgotten to set a machine key in web.config. However if you have done this then it is probably someone trying to do bad things (bots posting comments, someone trying to trigger events for disabled controls etc.) The cause of these should be tracked down if only to rule out potential security issues.

Whatever you do do not turn off viewstate or event validation.

Answer 4

One issue can be to do with users routers truncating form fields. The way around this is to set the MaxPageStateFieldLength to a smallish number (like 100) in web.config and the ViewState gets broken up into small chunks. It's very simple to do, and this article explains it fully.