Invalid viewstate error

Question

I'm getting an invalid viewstate error with regard to the ScriptResource.axd. Just wondering if anyone of you could help me on this. Error is:

2009-02-24 09:46:30,021 [13] DEBUG ASP.global_asax [(null)] - Request start - URL: /Web/ScriptResource.axd?d=E9hlvtsn8Gr1MyjysW1gFDFYr4CVwstY-sC22tRu5V8d7UyEYz3FhVYGrlhY87n2ihgKh58RrMRhK-Yk2WcQahEaCg_asTInqHK
2009-02-24 09:46:30,021 [13] DEBUG ASP.global_asax [(null)] - Application_AuthenticateRequest started
2009-02-24 09:46:30,021 [13] ERROR ASP.global_asax [(null)] - Unexpected error.  User presented with Site Error page.
System.Web.HttpException: Invalid viewstate.
   at System.Web.UI.Page.DecryptStringWithIV(String s, IVType ivType)
   at System.Web.UI.Page.DecryptString(String s)
   at System.Web.Handlers.ScriptResourceHandler.DecryptParameter(NameValueCollection queryString)
   at System.Web.Handlers.ScriptResourceHandler.ProcessRequestInternal(HttpResponse response, NameValueCollection queryString, VirtualFileReader fileReader)
   at System.Web.Handlers.ScriptResourceHandler.ProcessRequest(HttpContext context)
   at System.Web.Handlers.ScriptResourceHandler.System.Web.IHttpHandler.ProcessRequest(HttpContext context)
   at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
   at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)

This happens in production environment. I'm unable to reproduce this in dev nor test environments. Also these pages can only be accessed by authenticated users. It would be really if you could shed some light on this matter.

Answer 1

I'm getting the same errors, they actually just started in the last month or two, its been happening on a couple of our sites and we haven't changed any of them since December. This makes me think a configuration change or windows update is effecting it.

Answer 2

I would suggest looking at this...it basically outlines some cases where this can happen depending on the doctype. We had a similar issue, and it seemed to only show up erratically...for us it was a conflict between our XHTML doctype and the javascript we had on the page. We were able to solve it by insuring that all of our javascript was correctly wrapped in tags.

<script>
     mycode;
</script>

would become

<script>
// <![CDATA[
    mycode;
// ]]>
</script>

This may not be an identical issue, but if you have an xhtml doctype, look to see if you have unescaped characters that are not legal XML somewhere (such as '<' characters).

Answer 3

As said, this might happen if you are using a Web Farm and the machine keys are not in sync.

Another possibility is that the assembly date is in the future. This leads to all sorts of obscure problems and is worth checking. Maybe your server is in a different time zone?

Answer 4

I think these errors happen with different browsers for different reasons, which is what makes it so hard to track down.

IE8 Bug

Microsoft have said a bug in IE8 will (in some circumstances) generate spurious requests to the server, that do not affect the user but do lead to errors being logged at the server side.

See this discussion here: Bug IE8 – 4K dropped - "Invalid viewstate" when loading ScriptResource.axd (edit: link now requires login for some reason, sorry)

... particularly EricLaw-MSFT's update when he says:

It is worth mentioning that anyone who is experiencing a problem here in IE6/IE7 or Firefox is encountering a different problem that is not related to the IE8 issue described below.

This blog post also describes the bugs: Bugs in IE8's Lookahead Downloader

They say changing the way you set Content-Type will help with some of the errors, although not all of them - they say it is caused by various obscure circumstances that they are still looking at.

Update: As of 01/Apr/2010, these IE8 bugs have been fixed, via IE8 Cumulative Update (KB980182).
This post: IE8 Lookahead Downloader Fixed gives more detail on the bugs and other possible/partial workarounds (e.g this one) other than waiting for everyone in the world to download the fix.

Other Browsers

Haven't figured it out yet, but other browsers are also generating these errors, presumably for different reasons.

Web Farms

This problem is not restricted to sites running on web farms, but if you are running a farm, check out this answer by jesal which may help

Answer 5

I have noticed that the Firefox 3.1 Beta causes invalid viewstate errors. You might want to review your logs to see what browser that is being used when these errors occur.

Answer 6

Same error here for User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; AOL 9.0; Windows NT 6.0; Trident/4.0; GTB5; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30618)

I tried modifying/removing doctype declaration and warping the javascript in // <![CDATA[ and there are still exceptions...

For the moment all came from the same IP