locked
Validation of viewstate MAC failed RRS feed

  • Question

  • User1404574746 posted

    i have a website that i have configured to send me an email every time an error occurs, i keep getting the following error:

    Message: Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster. See http://go.microsoft.com/fwlink/?LinkID=314055 for more information.

    My web.config file already specify the validationKey and Algorithm but i still get this error, i cannot seem to replicate this error in my dev environment or even when i browse the website, does anyone know any other reason this might be happening?

    Saturday, April 25, 2015 12:44 PM

All replies

  • User2008642861 posted

    Hi disearches,

    Could you please tell me have you try the solutions provide by the link as below?

    http://go.microsoft.com/fwlink/?LinkID=314055

    I suggest that you could refer to the link and follow the suggestion provided from the link.

    Best regards,

    Archer

    Monday, April 27, 2015 3:04 AM
  • User1849925139 posted
    Hi,

    Please find below link sure it will helps you.

    https://support.microsoft.com/en-us/kb/2915218


    Regards,
    Santosh gada
    Monday, April 27, 2015 1:43 PM
  • User1849925139 posted
    Hi,

    Try this aswell.

    http://forums.asp.net/t/2042694.aspx?Validation+of+Viewstate+failed

    Regards,
    Santosh gada
    Monday, April 27, 2015 1:49 PM
  • User1404574746 posted

    Thanks for your responses

    Each of them have the Create an explicit <machineKey> element resolution and i already have that done. I am running a IIS 8.

    Tuesday, April 28, 2015 2:13 PM
  • User1368628272 posted

    I'm sure following links will help you to fix this problem 

    https://support.microsoft.com/en-us/kb/2915218

    http://www.codeproject.com/Questions/464873/Validation-of-viewstate-MAC-failed

    Still not able to solve do let me know, I'll guide you how to fix this hell :) 

    Monday, June 8, 2015 4:46 PM
  • User1404574746 posted

    i have tried everything in the links and other posts still no resolution. if i could even replicate the error i could better understand it, but i cant. its really ridiculous . Please help

    Tuesday, June 9, 2015 9:59 AM
  • User475983607 posted

    disearches

    i have tried everything in the links and other posts still no resolution. if i could even replicate the error i could better understand it, but i cant. its really ridiculous . Please help

    The key to understanding the issue is reading through provided the links.  Here's an snippet from a kb article.

    To prevent this kind of tampering attack, the __VIEWSTATE field is protected by a message authentication code (MAC). ASP.NET validates the MAC that is submitted together with the __VIEWSTATE payload when a postback occurs. The key that is used to calculate the MAC is specified in the application's <machineKey> element in the Web.config file. Because the attacker cannot guess the contents of the <machineKey> element, the attacker cannot provide a valid MAC if the attacker tries to tamper with the __VIEWSTATE payload. ASP.NET will detect that a valid MAC hasn't been provided, and ASP.NET will reject the malicious request.

    https://support.microsoft.com/en-us/kb/2915218

    I get the MAC error from time to time on my dev box and local host.  It usually happens after building an application without closing and re-opening the browser window that has been open for a long time.  I just always attributed this error - given all the steps above have been implemented - to the app pool re-cycling while a client is still working on the site.  I have not tested the theory... but you could?

    Are there any other errors in the event log at the same time as the MAC error?  Maybe implement more details in the logging module?

    Friday, June 12, 2015 10:01 AM
  • User753101303 posted

    Hi,

    Including defining an explicit key value? Try perhaps http://weblogs.asp.net/lduveau/viewstate-chunking-in-asp-net-2-0-maxpagestatefieldlength (and if I remember you can also move those fields at the end of the form).

    If I remember I had once an issue with buggy IE8 browsers and apart updating them to the latest patches, it helped to get rid of this.

    Have you tried to see if it happens mostly with huge viewstates or with a particular browser?

    Thursday, June 25, 2015 2:24 PM