Validation of viewstate MAC failed. - ASP.net

Question

I have an C# ASP.net website hosted with www.blacknight.com.

Sometimes when I login to my website I get the following error:

This happens in about 1 in ever 10 login attempts. I have contacted them and they assured me that its not hosted on a Web Farm or cluster and to check my ViewState.

Does anyone know what could be wrong here? I cant reproduce it everytime so its hard to track down.

Answer 1

Please see the KB article at http://support.microsoft.com/kb/2915218 for a resolution to this issue. In particular, you should set an explicit <machineKey> element in Web.config.

Appendix A of that article tells you how to generate a <machineKey> element.

Never set EnableViewStateMac=false. And you should never use a key that you got from a third-party generator. Only use one that you generated yourself.

Answer 2

Is it possible that IIS is recycling your application between the original page load, and the login attempt? If you don't specify a <machinekey /> in the web.config, a new machine key will be generated on application start up. And then, when you attempt to validate the viewstate that was generated on the old machine key during post back, this exception would be thrown.