ASP.NET: Unable to validate data.

Question

What is the cause of this exception in ASP.NET? Obviously it is a viewstate exception, but I can't reproduce the error on the page that is throwing the exception (a simple two TextBox form with a button and navigation links).

FWIW, I'm not running a web farm.

Exception

Error Message: Unable to validate data.

Error Source: System.Web

Error Target Site: Byte[] GetDecodedData(Byte[], Byte[], Int32, Int32, Int32 ByRef)

Post Data

VIEWSTATE:

/wEPDwULLTE4NTUyODcyMTFkZF96FHxDUAHIY3NOAMRJYZ+CKsnB

EVENTVALIDATION:

/wEWBAK+8ZzHAgKOhZRcApDF79ECAoLch4YMeQ2ayv/Gi76znHooiRyBFrWtwyg=

Exception Stack Trace

   at System.Web.UI.ViewStateException.ThrowError(Exception inner, String persistedState, String errorPageMessage, Boolean macValidationError)
   at System.Web.UI.ObjectStateFormatter.Deserialize(String inputString)
   at System.Web.UI.ObjectStateFormatter.System.Web.UI.IStateFormatter.Deserialize(String serializedState)
   at System.Web.UI.Util.DeserializeWithAssert(IStateFormatter formatter, String serializedState)
   at System.Web.UI.HiddenFieldPageStatePersister.Load()
   at System.Web.UI.Page.LoadPageStateFromPersistenceMedium()
   at System.Web.UI.Page.LoadAllState()
   at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
   at System.Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
   at System.Web.UI.Page.ProcessRequest()
   at System.Web.UI.Page.ProcessRequestWithNoAssert(HttpContext context)
   at System.Web.UI.Page.ProcessRequest(HttpContext context)
   at ASP.default_aspx.ProcessRequest(HttpContext context)
   at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
   at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)

~ William Riley-Land

Answer 1

The most likely cause of this error is when a postback is stopped before all the viewstate loads (the user hits the stop or back buttons), the viewstate will fail to validate and throw the error.

Other potential causes:

• An application pool recycling between the time the viewstate was generated and the time that the user posts it back to the server (unlikely).
• A web farm where the machineKeys are not synchronized (not your issue).

Update: Microsoft article on the issue. In addition to the above they suggest two other potential causes:

• Modification of viewstate by firewalls/anti-virus software
• Posting from one aspx page to another.

Answer 2

I've experienced the issue with certain specific versions of Safari 3. My solution was to move the ViewState to the top of the form (extended the Page class and overwrote the Render method for pre-3.5 SP1, or .Net 3.5 SP1 and later does this by default), and to split up the ViewState to several different fields instead of one monster file. See ViewState Chunking in ASP.NET 2.0 (maxPageStateFieldLength)

Answer 3

"a postback is stopped before all the viewstate loads"

I've had this exact problem before, and this was the cause.

Initially we disabled the ViewStateMac property (enableViewStateMac="false" in the page directive) to solve it, but this is not a true solution to the problem and can threaten data integrity. We ultimately resolved it by disabled our submit button until the page had completely loaded, and trimming the size of our viewstate by disabling it on some controls.

Answer 4

In .NET 3.5 SP1 the RenderAllHiddenFieldsAtTopOfForm property was added to the PagesSection configuration.

Web.config

<configuration>

    <system.web>

        <pages renderAllHiddenFieldsAtTopOfForm="true"></pages>

    </system.web>

</configuration>

Interestingly, the default value of this is true. So, in essence, if you are using .NET 3.5 SP1 then the ViewState is automatically being rendered at the top of the form (before the rest of the page is loaded) thus eliminating the ViewState error you are getting.

Answer 5

I got this error when I had a form tag setup on my page without an action attribute, and then in the code-behind, I changed the form's action attribute to "Action.aspx".

And in JavaScript, I submitted the form (theForm.submit();)

I think in my case it was a security issue, and that you can't change this after it's already been set on the page... ?

Answer 6

I am afraid i have no answers but are suffering a similer problem.

Here is the stack trace:-

[HttpException (0x80004005): Unable to validate data.] System.Web.Configuration.MachineKeySection.GetDecodedData(Byte[] buf, Byte[] modifier, Int32 start, Int32 length, Int32& dataLength) +289 System.Web.UI.ObjectStateFormatter.Deserialize(String inputString) +140

[ViewStateException: Invalid viewstate. Client IP: 192.168.0.2 Port: 1469 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) ViewState: /wEPDwUKMTc4MTM4NzM1OQ8WAh4JYXJ0aWNsZWlkBQExFgJmDxYCHghPblN1Ym1pdAUUcmV0dXJuIGdldGNvbnRlbnQoKTsWHAIHDxBkDxYMZgIBAgICAwIEAgUCBgIHAggCCQIKAgsWDBAFB0phbnVhcnkFATFnEAUIRmVicnVhcnkFATJnEAUFTWFyY2gFATNnEAUFQXByaWwFATRnEAUDTWF5BQE1ZxAFBEp1bmUFATZnEAUESnVseQUBN2cQBQZBdWd1c3QFAThnEAUJU2VwdGVtYmVyBQE5ZxAFB09jdG9iZXIFAjEwZxAFCE5vdmVtYmVyBQIxMWcQBQhEZWNlbWJlcgUCMTJnZGQCCA8QZA8WH2YCAQICAgMCBAIFAgYCBwIIAgkCCgILAgwCDQIOAg8CEAIRAhICEwIUAhUCFgIXAhgCGQIaAhsCHAIdAh4WHxAFATEFATFnEAUBMgUBMmcQBQEzBQEzZxAFATQFATRnEAUBNQUBNWcQBQE2BQE2ZxAFATcFATdnEAUBOAUBOGcQBQE5BQE5ZxAFAjEwBQIxMGcQBQIxMQUCMTFnEAUCMTIFAjEyZxAFAjEzBQIxM2cQBQIxNAUCMTRnEAUCMTUFAjE1ZxAFAjE2BQIxNmcQBQIxNwUCMTdnEAUCMTgFAjE4ZxAFAjE5BQIxOWcQBQIyMAUCMjBnEAUCMjEFAjIxZxAFAjIyBQIyMmcQBQIyMwUCMjNnEAUCMjQFAjI0ZxAFAjI1BQIyNWcQ...]

[HttpException (0x80004005): Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.] System.Web.UI.ViewStateException.ThrowError(Exception inner, String persistedState, String errorPageMessage, Boolean macValidationError) +106 System.Web.UI.ViewStateException.ThrowMacValidationError(Exception inner, String persistedState) +14 System.Web.UI.ObjectStateFormatter.Deserialize(String inputString) +242 System.Web.UI.ObjectStateFormatter.System.Web.UI.IStateFormatter.Deserialize(String serializedState) +4 System.Web.UI.Util.DeserializeWithAssert(IStateFormatter formatter, String serializedState) +37 System.Web.UI.HiddenFieldPageStatePersister.Load() +207 System.Web.UI.Page.LoadPageStateFromPersistenceMedium() +105 System.Web.UI.Page.LoadAllState() +43 System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +6785 System.Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +242 System.Web.UI.Page.ProcessRequest() +80 System.Web.UI.Page.ProcessRequestWithNoAssert(HttpContext context) +21 System.Web.UI.Page.ProcessRequest(HttpContext context) +49 ASP.editzone_aspx.ProcessRequest(HttpContext context) +4 System.Web.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +181 System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +75

Your thoughts and comments would be apreciated.

R,C.Gornall

Answer 7

I've found the root of this problem in my web site and I finally managed to solve it. This is not a direct answer to your question, but I wanted to share this little piece of information.

In the past I tried everything (including the solution proposed by Jeffaxe, above) but with no result, and I didn't want to set enableViewStateMac="false" (as Raelshark mentions above) to my page, because this just hides the problem.

What caused the problem in my case? The problem was caused by the use of the Intelligencia.UrlRewriter (Version 2.0 RC 1 build 6) module in certain pages of my web site. I was using some SEO friendly links and that was causing the ViewState validation failure. When I used "normal" links (instead of the SEO-friendly links) the problem disappeared!

I reproduced the problem a few times to make sure it was not a false alarm (I use ASP.NET 3.5).

I know that some of you may not use the above module, and still get this error, which implies that the cause is something else. At least, sharing this experience might be helpful to some.