Invalid viewstate error

Question

I'm getting an invalid viewstate error with regard to the ScriptResource.axd. Just wondering if anyone of you could help me on this. Error is:

2009-02-24 09:46:30,021 [13] DEBUG ASP.global_asax [(null)] - Request start - URL: /Web/ScriptResource.axd?d=E9hlvtsn8Gr1MyjysW1gFDFYr4CVwstY-sC22tRu5V8d7UyEYz3FhVYGrlhY87n2ihgKh58RrMRhK-Yk2WcQahEaCg_asTInqHK
2009-02-24 09:46:30,021 [13] DEBUG ASP.global_asax [(null)] - Application_AuthenticateRequest started
2009-02-24 09:46:30,021 [13] ERROR ASP.global_asax [(null)] - Unexpected error.  User presented with Site Error page.
System.Web.HttpException: Invalid viewstate.
   at System.Web.UI.Page.DecryptStringWithIV(String s, IVType ivType)
   at System.Web.UI.Page.DecryptString(String s)
   at System.Web.Handlers.ScriptResourceHandler.DecryptParameter(NameValueCollection queryString)
   at System.Web.Handlers.ScriptResourceHandler.ProcessRequestInternal(HttpResponse response, NameValueCollection queryString, VirtualFileReader fileReader)
   at System.Web.Handlers.ScriptResourceHandler.ProcessRequest(HttpContext context)
   at System.Web.Handlers.ScriptResourceHandler.System.Web.IHttpHandler.ProcessRequest(HttpContext context)
   at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
   at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)

This happens in production environment. I'm unable to reproduce this in dev nor test environments. Also these pages can only be accessed by authenticated users. It would be really if you could shed some light on this matter.

Empirical

Are you using a Web Farm in your production environment? – Animatism

Answer 1

I think these errors happen with different browsers for different reasons, which is what makes it so hard to track down.

IE8 Bug

Microsoft have said a bug in IE8 will (in some circumstances) generate spurious requests to the server, that do not affect the user but do lead to errors being logged at the server side.

See this discussion here: Bug IE8 – 4K dropped - "Invalid viewstate" when loading ScriptResource.axd (edit: link now requires login for some reason, sorry)

... particularly EricLaw-MSFT's update when he says:

It is worth mentioning that anyone who is experiencing a problem here in IE6/IE7 or Firefox is encountering a different problem that is not related to the IE8 issue described below.

This blog post also describes the bugs: Bugs in IE8's Lookahead Downloader

They say changing the way you set Content-Type will help with some of the errors, although not all of them - they say it is caused by various obscure circumstances that they are still looking at.

Update: As of 01/Apr/2010, these IE8 bugs have been fixed, via IE8 Cumulative Update (KB980182).
This post: IE8 Lookahead Downloader Fixed gives more detail on the bugs and other possible/partial workarounds (e.g this one) other than waiting for everyone in the world to download the fix.

Other Browsers

Haven't figured it out yet, but other browsers are also generating these errors, presumably for different reasons.

Web Farms

This problem is not restricted to sites running on web farms, but if you are running a farm, check out this answer by jesal which may help

Cornall

Answer 2

As said, this might happen if you are using a Web Farm and the machine keys are not in sync.

Another possibility is that the assembly date is in the future. This leads to all sorts of obscure problems and is worth checking. Maybe your server is in a different time zone?

Animatism

Answer 3

I would suggest looking at this...it basically outlines some cases where this can happen depending on the doctype. We had a similar issue, and it seemed to only show up erratically...for us it was a conflict between our XHTML doctype and the javascript we had on the page. We were able to solve it by insuring that all of our javascript was correctly wrapped in tags.

<script>
     mycode;
</script>

would become

<script>
// <![CDATA[
    mycode;
// ]]>
</script>

This may not be an identical issue, but if you have an xhtml doctype, look to see if you have unescaped characters that are not legal XML somewhere (such as '<' characters).

Recurve

Answer 4

MS recommends not declaring your charset using a meta tag and setting it as a HTTP header instead.

So remove

<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=utf-8">

and add

Response.AddHeader("Content-Type", "text/html; charset=utf-8");

Natality

That will help for some, but not all cases. – Secede

Answer 5

This can happen if the machineKey of the app pool that receives the request for scriptresource.axd is different from that of the app pool that served the original page. This is most likely if you're using a web farm. It can also happen on a single server if the app pool restarts, as a new machine key will be generated. The solution to either is to put an fixed machineKey in your web.config.

Asis

Answer 6

I have noticed that the Firefox 3.1 Beta causes invalid viewstate errors. You might want to review your logs to see what browser that is being used when these errors occur.

Pocahontas

Hi Matt, Yes, I reviewed the logs. It's happened to IE8, IE7 & also FF3. So It's hard to believe that it's a browser specific issue. I'm still digging :) Thanks! – Jugoslavia

Answer 7

Same error here for User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; AOL 9.0; Windows NT 6.0; Trident/4.0; GTB5; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30618)

I tried modifying/removing doctype declaration and warping the javascript in // <![CDATA[ and there are still exceptions...

For the moment all came from the same IP

Devilmaycare

(That's the same IE8 bug. Note the "Trident/4.0" in the UA string). – Secede

Answer 8

I'm getting the same errors, they actually just started in the last month or two, its been happening on a couple of our sites and we haven't changed any of them since December. This makes me think a configuration change or windows update is effecting it.

Arrest

Answer 9

How large is the view state? Some proxy servers will truncate a large view state.

It is easy to abuse viewstate since it is turned on by default. If you do have a large viewstate then you probably want to look into disabling view state on controls that do not need it.

Optimist