asp.net - Should I ignore the occasional Invalid viewstate error?

Question

Every now and then (once every day or so) we're seeing the following types of errors in our logs for an ASP.NET 3.5 application

• Invalid viewstate
• Invalid postback or callback argument

Are these something that "just happens" from time-to-time with an ASP.NET application? Would anyone recommend we spend a lot of time trying to diagnose what's causing the issues?

Answer 1

Well it depends. Invalid viewstate can happen for a variety of reasons.

1. Viewstate is too big and has not finished rendering before a user causes a postback on the page. The fix is generally to disable all controls that trigger postbacks and enable them client side once the page has finished loading - see http://blogs.msdn.com/tom/archive/2008/03/14/validation-of-viewstate-mac-failed-error.aspx
2. You are using viewstate MACs (and you should be, for security reasons) but you have not set a machine key and the application pool has recycled generating a new one. Don't forget to set a ViewStateUserKey.
3. Someone is using an old version of IE on the mac where it truncates hidden form fields. In this case you'll need to move viewstate out of the page into session state.
4. Viewstate MAC issues generally indicate you're on a web farm and have forgotten to set a machine key in web.config. However if you have done this then it is probably someone trying to do bad things (bots posting comments, someone trying to trigger events for disabled controls etc.) The cause of these should be tracked down if only to rule out potential security issues.

Whatever you do do not turn off viewstate or event validation.