ASP.NET Viewstate validation - ASP.NET 1.1 vs. ASP.NET 3.5

Question

Hi all,

we're in the process of migrating our web app from ASP.NET 1.1 to ASP.NET 3.5. Our app runs on multiple servers through DNS round robin, so every browser request may end up on a different server. We do have a in our web.config to prevent validation errors.

However, our plan was to migrate one server at a time. Now it looks like when a user loads the page on a 1.1. server and then the page ends up on a 3.5 server on postback, the viewstate validation fails.

I haven't been able to find anything on the web regarding this issue - it's just my guess that the viewstate validation is incompatible between 1.1. and 3.5, i.e. a viewstate generated by 1.1 will not validate on 3.5 even with the same machineKey and vice versa.

Can anyone confirm this suspicion?

Thanks

Answer 1

Use sticky sessions as mentioned in this similar post. This will keep users on the same machine for a period of time.

I don't think it wise to allow a single user to hit three different versions of the framework in a single session.

Answer 2

We don't really have a load balancer, otherwise this would be an obvious solution, yes.

Answer 3

Are you running IIS7 for the 3.5 host? I ran into a lot of issues with ViewState running a 1.1 app on IIS7. Getting a 1.1 app running properly on IIS7 is diffucult enough, let alone trying to web-garden across multiple framework versions. The biggest thing I ran into is that ViewState is encrypted or managed differently than previos version of IIS. If you try to setup a weg-garden on a 1.1 you get all kinds of ViewState encryption errors. You cannot setup a web garden (have multiple worker threads) on a 1.1 app on IIS7. At least from my experience.

Answer 4

I believe 1.1 and 2.0 use different default encryption algorithms for the viewstate. The default for 1.1 was 3DES and I believe for 2.0 it was SHA1 (Although I can't seem to find the documentation to back this up at the moment). Try setting the validation in your machine key to 3DES on the new server and see if that solves the problem.

<machineKey validation="3DES">

Answer 5

No, still running IIS6 for 3.5 as well.

We do have the encryption algorithm specified in the machine key.

Answer 6

One more thing: 3.5 runs on a 64bit OS while the 1.1 servers all run 32bit Windows. Would that matter?