验证视图MAC失败 Validation of ViewState MAC Failed

今天在调试Atlas时遇到错误：

验证视图MAC失败。如果此引用程序由网络场或群集承载，请确保<machineKey>配置指定了相同的 validationKey 和验证算法。不能在群集中使用 AutoGenerate

发生错误的环境：

ASP.NET 2.0，使用Atlas的UpdatePanel，在UpdatePanel中动态加载用户控件，以达到动态更新页面的效果。其中有一个用户控件中使用了GridView。当动态切换页面时，出现上述错误。

问题分析：

经过一番搜索，找到以下的文章：

http://aspadvice.com/blogs/joteke/archive/2006/02/02/15011.aspx

http://forums.asp.net/1173230/ShowPost.aspx

分析后找到了问题的根源。首先，文章中提到，如果用GridView，并且指定了DataKeyNames属性，则出于安全的理由（因为DataKeyNames指定的字段代表数据的主键，且该主键值需要保存在视图状态中发送到客户端，用户如果篡改主键值，会导致安全问题），GridView会要求加密视图状态。为此会自动在页面表单</forms>之前添加一个<input type="hidden" name="__VIEWSTATEENCRYPTED" id="__VIEWSTATEENCRYPTED" value="" /> 。

然而，Atlas的UpdatePanel要求放置在<form></form>内部，也就是</form>之前。这就意味着添加的隐藏input控件没有被放置在UpdatePanel内，而是放置在UpdatePanel和</form>之间。

当UpdatePanel更新时，UpdatePanel内部的控件被提交到服务器进行处理（Patrial Rendering），而整个页面并没有被提交。也就是说隐藏的input控件没有随着一起提交。因此服务器并不知道提交的ViewState被加密了，从而导致MAC验证错误。

解决方法：

通过在Web.config里边添加

<pages enableEventValidation="false" viewStateEncryptionMode ="Never" />

可以解决该问题。

ASP.NET 2.0 and "Validation of ViewState Mac failed" exception

If you get this Exception

[HttpException (0x80004005): Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that <machineKey> configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.]

and

• you know *for sure* that you aren't using a web farm
• it seems that it appears when using built-in databound controls such as GridView, DetailsView or FormView which utilize DataKeyNames.
• it appears if you have a large page which loads slowly for any reason

If following preconditions are true and you click a postbacking control/link while the Page hasn't loaded completely, you might get the "Validation of ViewState MAC failed"  exception. In this case be sure to check following post on ASP.NET Forums where this has been discussed quite thoroughly : http://forums.asp.net/1173230/ShowPost.aspx

It appears because GridView using DataKeyNames requires ViewState to be encrypted. And when ViewState is encrypted, Page adds  <input type="hidden" name="__VIEWSTATEENCRYPTED" id="__VIEWSTATEENCRYPTED" value="" /> field just before closing of the <form> tag. But this hidden field might not bet yet rendered to the browser with long-running pages, and if you make a postback before it "gets down", browser initiates postback without this field (in form post collection)

End result is that if this field is omitted on postback, Page doesn't "know" that viewstate is encrypted and causes the prementioned Exception. E.g Page expects to be fully-loaded before you can make a postback. And by the way similar problem is with event validation since __EVENTVALIDATION field is also rendered on the end of the form.

A way to overcome the problem is to set in web.config pages enableEventValidation="false" viewStateEncryptionMode ="Never" />Just note the security implications of these!

• <

   

EDIT: I also sent some feedback on the MS's product feedback system: http://lab.msdn.microsoft.com/ProductFeedback/viewfeedback.aspx?feedbackid=e08714b5-35cc-4520-9876-fe2851018453

Published Thursday, February 02, 2006 5:44 PM by joteke

Filed under: .NET

Comments

# re: ASP.NET 2.0 and &quot;Validation of ViewState Mac failed&quot; exception

hey joteke,

it's a very good description of the problem we've "solved" together - or better - you've solved :-)

keep up the good work,
cheerio

crystal.net

Monday, February 06, 2006 3:47 AM by crystal.net

# re: ASP.NET 2.0 and &quot;Validation of ViewState Mac failed&quot; exception

We ran into this problem yesterday when beta testing an app built in .net 2.0. The only difference between our problem and yours is that we do have a web farm; two '03 servers that are load balanced via the built in network balancing features of win2003.

The page in question has about 90 user controls (textboxes and checkboxes) and some serious javascript / c# code in place. It contains one formview with the DataKeyNames value set. The page load time is around a full second between sending it to the browser, and the browsers startup script doing the appropriate wizardry.

None of our other pages exhibited a problem with the webfarm.

I implemented the fix you suggested and it works perfectly. So, I just wanted to drop a note that this does happen in a webfarm scenario as well.

Thanks!

Monday, February 13, 2006 1:49 PM by Chris Lively

# re: ASP.NET 2.0 and &quot;Validation of ViewState Mac failed&quot; exception

Hi Chris,

interesting though of course slow loading Page applies in web farm too. It's just that it's more often the validation key setting that's missing from machines in web farm scenario.

Monday, February 13, 2006 2:32 PM by Teemu

# re: ASP.NET 2.0 and &quot;Validation of ViewState Mac failed&quot; exception

I got the same error in a completely different scenario. I'm offering it here so it may help others.

I had a master page where I (mistakenly, as I discovered later) had added a nested form inside the form tag that's already there by default. This generated no errors.

But when I created a page based on this master page, and added a FormView, I got the error when I tried to edit a record. It went away when I modified the web.config file as suggested above, but editing the formview data always failed (it cleared all the fields).

As soon as I removed the nested form in the master page, everything was OK.

Jos

Thursday, February 23, 2006 8:16 AM by Jos Branders

# re: ASP.NET 2.0 and &quot;Validation of ViewState Mac failed&quot; exception

The security implications worry me. I get this error when running the Quickstart Trigger application on Microsoft's own site. Seems like there should be a better solution somehow.

Saturday, February 25, 2006 4:41 PM by Peter Kellner

# re: ASP.NET 2.0 and &quot;Validation of ViewState Mac failed&quot; exception

It definately should be fixed with the right solution, e.g so that you wouldn't need to turn anything security related off. That's why I sent the report to MS Feedback system.

Note that with ASP.NET 1.x there was no event validation or viewstate encryption so what you miss is the added security in v2, if you use these workarounds (which were meant to the case when the issue occurs with one of the databound controls, and when you are sure your host etc is not using a web farm).

If you use SSL for the web site, it basically is a moot point, though not of course removing the need of these for sites not using SSL.

The one you get on www.asp.net is most probably indeed related to the web farm as the site uses such, as far as I know. You should use the site's Feedback forum: http://forums.asp.net/188/ShowForum.aspx

I can also ping someone on Telligent so that they are aware of it.

Sunday, February 26, 2006 2:18 AM by joteke

# re: ASP.NET 2.0 and &quot;Validation of ViewState Mac failed&quot; exception

Thanks very much.

I was using GridView control, When i was using paging I was getting same error message, However I used your solution and It works very nice.

Thanks again.

Raj Gohil

Wednesday, April 12, 2006 3:37 PM by Raj Gohil

# re: ASP.NET 2.0 and "Validation of ViewState Mac failed" exception

Hi Guys,
I got the solution of this problem.
The cause of this problem is multiple form tag in pages.
there should be only one pair of form tag in page.
Mahesh
singh.mahesh@gmail.com
www.o3developers.com

Wednesday, May 10, 2006 3:19 AM by Mahesh

# 验证视图状态 MAC 失败。如果此应用程序由网络场或群集承载，请确保 配置指定了相同的 validationKey 和验证算法。不能在群集中使用 AutoGenerate。

谢谢: http://blog.csdn.net/cjdchen/archive/2006/03/31/645660.aspx

Monday, May 15, 2006 4:21 AM by longren629

# re: ASP.NET 2.0 and "Validation of ViewState Mac failed" exception

Thank you!

Thursday, May 18, 2006 12:20 PM by Randy Jackson

# re: ASP.NET 2.0 and "Validation of ViewState Mac failed" exception

Check this out:
http://www.andreas-kraus.net/blog/validation-of-viewstate-mac-failed/

It might be the solution until it's officially fixed.

Thursday, June 22, 2006 7:15 AM by Andreas Kraus

# re: ASP.NET 2.0 and "Validation of ViewState Mac failed" exception

我使用

<pages enableEventValidation="false" viewStateEncryptionMode="Never"/>
did not solve my problem, but
<pages enableEventValidation="false" viewStateEncryptionMode="Never" enableViewStateMac="false"/>
did ;)

Saturday, June 24, 2006 7:25 AM by Infinum

# re: ASP.NET 2.0 and "Validation of ViewState Mac failed" exception

Thanks Infinum, that solve my problem also!

Wednesday, July 12, 2006 11:15 AM by masa

# re: ASP.NET 2.0 and "Validation of ViewState Mac failed" exception

Esto resolvió mi problema

<pages enableEventValidation="false" viewStateEncryptionMode="Never" enableViewStateMac="false"/>

Thursday, July 13, 2006 11:18 AM by buitre

# re: ASP.NET 2.0 and "Validation of ViewState Mac failed" exception

I have a very basic aspx page. I do not have any controls apart from some text boxes and just one form. I get this error when I leave the page idle for long. I do not think it occurs when session expires because I made the session timeout for 1 min, but still it occurs when I leave the page idle for more than 20 minutes... any clue whats going on?

Tuesday, July 18, 2006 10:28 AM by Anil

# 网站测试中出现 验证视图MAC失败

在网站测试中出现了验证视图MAC失败
验证视图MAC失败。如果此引用程序由网络场或群集承载，请确保&amp;lt;machineKey&amp;gt;配置指定了相同的 validationKey 和验证算法。不能在群集中使用...

Thursday, July 20, 2006 2:43 AM by Joe's Blog

# re: ASP.NET 2.0 and "Validation of ViewState Mac failed" exception

Thanks ... it was perfectly, but is there any disadvatatges of disabling validation ?

Wednesday, August 02, 2006 9:00 AM by Laith Murad

# Validation of viewstate MAC failed

hi, i used atlas in a page and users of my website got below error:Validation of viewstate MAC failed.

Friday, August 04, 2006 3:00 PM by ATLAS Forum Posts