ViewState decoding failure when client connects via multiple IP's per request

Question

We have a semi-weird issue for our site.

Consistently, from 1 anonymous* user the following error occurs:

Exception type: System.FormatException

Exception message: Invalid length for a Base-64 char array.

After some investigation, it appears the user is using some form of load-balancing firewall, as the IIS logs shows the requests originating from 2 different (but successive) IP's.

From what I can determine, disabling 'ViewStateMAC' should solve this issue.

I am not however sure, and without any way to test this with the user, I feel a bit reluctant to go ahead with that.

Has anyone experienced similar issues? How did you deal with them?

Server details:

Single server (Win2003) running from a single IP.

Update:

From what I can determine, ViewStateMAC is only for the server-side. My issue is due to a client posting back a single page with multiple IP's.

* But from the same 2 IP's as determined from IIS logs. The user is also not malicious.

Answer 1

Disabling viewstatemac will not solve the problem; ViewStateMac failures happen when you have multiple web server, not when a user is coming from multiple IP addresses.

Are you using a viewstateuserkey by any chance? Even then, that's a long shot as you would get a different exception.

I'd be tempted, if the user can recreate it on a consistent basis, to have them install fiddler and log requests until it happens then have them send them to you. Then replay them from your side and see if the error occurs.

They're not using IE on a mac are they? That corrupts long viewstate due to a bug in form field lengths.

Answer 2

Hey - we're seeing an unusual amount of these errors on an application that - due to client requirement and lack of guidance on these - use an excessive amount of controls and in particular GridViews on each page.

The obvious culprit was the length of the viewstate which in some extreme cases was +50k characters long. As this is an administrative application only used by a limited set of users we initially solved this completely by moving the viewstate into session using an adapted version of the solution outlined in this excellent (thou slightly dated) article: http://msdn.microsoft.com/en-us/magazine/cc163577.aspx However this gave us issues with people using the back button and/or tabbed browsing.

Next we then added some extra logging code - and confirmed that the issue was indeed just what the error said - base-64 encoded strings must have a length that is dividable by 4 - and when we got this error that was never the case. The assumption was that some proxies and/or firewalls we're simply chopping off the viewstate string at some point. We then used ASP.NET's ViewStateChunking to split the field over several hidden fields - we're still monitoring this solution.

However - I recently got the error on a viewstate field that had a valid length - however the __EVENTVALIDATION field length was invalid on this.

On the page where this happened we have fields that have "+" signs in them (telephone codes) - I am currently looking into if all this is perhaps caused by invalid encoding of the original strings (as + signs have a special meaning in base-64 endoded strings).