Error while posting data from ASP.Net 4.5 to ASP.Net 2.0 web application

Question

We caught up in the following scenario:

• We have a web application which runs on .Net 2.0 framework.
• Customer has a web application which runs on .Net 4.5 framework.

When they are posting data from one of their page to our pages, we are getting system errors. To validate the issue I have deployed two web applications on same server and tried to post a form from webapp 1 (on 4.5) to webapp 2 (on 2.0). I am getting below error.

[ViewStateException: Invalid viewstate. 
Client IP: 127.0.0.1
Port: 63153
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
ViewState: /wEPDwUKLTM1MTA1NjA1MmRk6CPd6yG4r8HEbqBZi3i4jiLLnZotIlX7+6zAZaceaGY=
Referer: http://localhost/test4/default.aspx
Path: /test2/default.aspx]

[HttpException (0x80004005): Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that <machineKey> configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.]
System.Web.UI.ViewStateException.ThrowError(Exception inner, String persistedState, String errorPageMessage, Boolean macValidationError) +148
System.Web.UI.ObjectStateFormatter.Deserialize(String inputString) +11065601
System.Web.UI.Util.DeserializeWithAssert(IStateFormatter formatter, String serializedState) +59
System.Web.UI.HiddenFieldPageStatePersister.Load() +11065704
System.Web.UI.Page.LoadPageStateFromPersistenceMedium() +11150648
System.Web.UI.Page.LoadAllState() +46
System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +11146167
System.Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +11145706
System.Web.UI.Page.ProcessRequest() +91
System.Web.UI.Page.ProcessRequest(HttpContext context) +240
ASP.default_aspx.ProcessRequest(HttpContext context) in     c:\Windows\Microsoft.NET\Framework64\v2.0.50727\Temporary ASP.NET     Files\test2\b4717a74\d7ba8639\App_Web_ha1suqrp.0.cs:0
System.Web.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +599
System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +171

I tried the following:

• EnableViewState = false in Page tag. But still .Net is adding a _VIEWSTATE hidden variable.

• Added a Javascript function to set _VIEWSTATE hidden variable to empty. This resolved the issue.

Though second work solutions resolved the problem, I am looking for better ways to solve this kind of issue.

Answer 1

EnableViewState = false only turns off the ViewState, but not the control state of the ASP.NET server controls, that's why you still have the hidden VIEWSTATE control.

The ViewState is hash coded on the server, therefore you should use the same key's to generate the hash. You set the <machinekey> in your machine.config file to the same value on both applications/servers. The default value is AutoGenerate , which means that every server has it's own machinekey. You find more information here

As an alternative you turn the hashing off by setting EnableViewstateMac to false (basically what your error message says). By doing this users could manipulate your ViewState.