Invalid viewstate error

Question

I'm getting an invalid viewstate error with regard to the ScriptResource.axd. Just wondering if anyone of you could help me on this. Error is:

2009-02-24 09:46:30,021 [13] DEBUG ASP.global_asax [(null)] - Request start - URL: /Web/ScriptResource.axd?d=E9hlvtsn8Gr1MyjysW1gFDFYr4CVwstY-sC22tRu5V8d7UyEYz3FhVYGrlhY87n2ihgKh58RrMRhK-Yk2WcQahEaCg_asTInqHK
2009-02-24 09:46:30,021 [13] DEBUG ASP.global_asax [(null)] - Application_AuthenticateRequest started
2009-02-24 09:46:30,021 [13] ERROR ASP.global_asax [(null)] - Unexpected error.  User presented with Site Error page.
System.Web.HttpException: Invalid viewstate.
   at System.Web.UI.Page.DecryptStringWithIV(String s, IVType ivType)
   at System.Web.UI.Page.DecryptString(String s)
   at System.Web.Handlers.ScriptResourceHandler.DecryptParameter(NameValueCollection queryString)
   at System.Web.Handlers.ScriptResourceHandler.ProcessRequestInternal(HttpResponse response, NameValueCollection queryString, VirtualFileReader fileReader)
   at System.Web.Handlers.ScriptResourceHandler.ProcessRequest(HttpContext context)
   at System.Web.Handlers.ScriptResourceHandler.System.Web.IHttpHandler.ProcessRequest(HttpContext context)
   at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
   at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)

This happens in production environment. I'm unable to reproduce this in dev nor test environments. Also these pages can only be accessed by authenticated users. It would be really if you could shed some light on this matter.

Answer 1

MS recommends not declaring your charset using a meta tag and setting it as a HTTP header instead.

So remove

<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=utf-8">

and add

Response.AddHeader("Content-Type", "text/html; charset=utf-8");

Answer 2

This can happen if the machineKey of the app pool that receives the request for scriptresource.axd is different from that of the app pool that served the original page. This is most likely if you're using a web farm. It can also happen on a single server if the app pool restarts, as a new machine key will be generated. The solution to either is to put an fixed machineKey in your web.config.

Answer 3

How large is the view state? Some proxy servers will truncate a large view state.

It is easy to abuse viewstate since it is turned on by default. If you do have a large viewstate then you probably want to look into disabling view state on controls that do not need it.