If EnableViewStateMAC is set to true, ASP.NET will generate a hashcode for the ViewState data and compare it to the hashcode stored in the posted value. What prevents an attacker from setting the hash based on the altered form values?
If EnableViewStateMAC is set to true, ASP.NET will generate a hashcode for the ViewState data and compare it to the hashcode stored in the posted value. What prevents an attacker from setting the hash based on the altered form values?