Should I ignore the occasional Invalid viewstate error?

asp.net error-handling viewstate
Richard Ev picture Richard Ev · Feb 23, 2009 · Viewed 29.2k times · Source

Every now and then (once every day or so) we're seeing the following types of errors in our logs for an ASP.NET 3.5 application

  • Invalid viewstate
  • Invalid postback or callback argument

Are these something that "just happens" from time-to-time with an ASP.NET application? Would anyone recommend we spend a lot of time trying to diagnose what's causing the issues?

Answer

blowdart picture blowdart · Feb 23, 2009

Well it depends. Invalid viewstate can happen for a variety of reasons.

  1. Viewstate is too big and has not finished rendering before a user causes a postback on the page. The fix is generally to disable all controls that trigger postbacks and enable them client side once the page has finished loading - see http://blogs.msdn.com/tom/archive/2008/03/14/validation-of-viewstate-mac-failed-error.aspx
  2. You are using viewstate MACs (and you should be, for security reasons) but you have not set a machine key and the application pool has recycled generating a new one. Don't forget to set a ViewStateUserKey.
  3. Someone is using an old version of IE on the mac where it truncates hidden form fields. In this case you'll need to move viewstate out of the page into session state.
  4. Viewstate MAC issues generally indicate you're on a web farm and have forgotten to set a machine key in web.config. However if you have done this then it is probably someone trying to do bad things (bots posting comments, someone trying to trigger events for disabled controls etc.) The cause of these should be tracked down if only to rule out potential security issues.

Whatever you do do not turn off viewstate or event validation.

Related questions

Deploying website: 500 - Internal server error

I am trying to deploy an ASP.NET application. I have deployed the site to IIS, but when visiting it with the browser, it shows me this: Server Error 500 - Internal server error. There is a problem with the resource …

Read More
ASP.NET MVC Custom Error Handling Application_Error Global.asax?

I have some basic code to determine errors in my MVC application. Currently in my project I have a controller called Error with action methods HTTPError404(), HTTPError500(), and General(). They all accept a string parameter error. Using or modifying the …

Read More
How do you log errors (Exceptions) in your ASP.NET apps?

I'm looking for the best way to log errors in an ASP.NET application. I want to be able to receive emails when errors occurs in my application, with detailed information about the Exception and the current Request. In my …

Read More