Monday, July 14, 2014

Validation of viewstate MAC failed





Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that <machineKey> configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.




The first option is to set the EnableViewStateMac to false in the web.config. This is an attribute of the Page tag. You also have the option to set the EnableViewStateMac to false at page level. The only drawback  with this option is that you need to do this for all page across the application.
In web.config

<pages enableViewStateMac="false">
.
.
</pages>

At page level
<%@ Page Language="C#" AutoEventWireup="false" CodeFile="Default.aspx.cs" Inherits="_Default"
 EnableViewStateMac="false" %>


Other option is to specify your own value for encryption and decryption key in the web.config . Now this key will be same across the servers.
Both the option will work perfectly, but it is always advisable to go with specifying the custom key for encryption and decryption in web.config. This is because when you set the EnableViewStateMac value to false you expose your application to security threats. This is because validation of view state will not happen in this case.

<machineKey validationKey="<encryptionkey>" decryptionKey="<decryptionkey>" validation="SHA1" decryption="Auto"/>

Machine key Generate from here -  
http://www.a2zmenu.com/utility/Machine-Key-Generator.aspx