Separation of concerns in asp.net cause hierarchy mess

Question

I’m designing a back office web site, one that will enable administrators to manage content, products, prices and such. I have two issues I’d like to solve in a base class that each page controller (i.e. code-behind class) will extend, and these are:

1. Storing of ViewState on disk, and
2. User validation.

Furthermore, I would like each page controller to follow the same design when it comes to setting event handlers, populating the form and saving the data. I would like to solve this issue by creating abstract methods that the page controllers implement.

Now, creating a base class that caters for ViewState storage and user validation, and furthermore defines how and when event handlers are set, forms are populated and data is persisted to me is too much of a mess. I like a high degree of separation of concerns and I’m drawn towards creating three base classes:

System.Web.UI.Page
|
FileSystemStatePage : System.Web.UI.Page
(storing of ViewState)
|
SecurePage : FileSystemStatePage
(user validation)
|
PageBase : SecurePage
(abstract, defines methods for setting event handlers, form population, saving)

Now I am quite happy with the separation of concerns, but I’m not thrilled about the deep class hierarchy. What if I find myself in the need of user validation but not ViewState on disk? So...

...how do you guys usually solve these issues?

public class FileSystemStatePage : Page
{
    protected override void SavePageStateToPersistenceMedium(object viewState)
    {
     // Serialize ViewState...
     // Save to disk...
    }

    protected override object LoadPageStateFromPersistenceMedium()
    {
// Read file content...
// Deserialize and return...
    }
}

public class SecurePage : FileSystemStatePage
{
    protected override void OnInit(EventArgs e)
    {
        if (!ValidateUser()) Response.Redirect("~/Login.aspx");

        base.OnInit(e);
    }

    protected virtual bool ValidateUser()
    {
        return LoginHelper.LoggedInSystemUser != null;
    }
}

public abstract class PageBase : SecurePage
{
    protected override void OnInit(EventArgs e)
    {
        base.OnInit(e);
        SetEventHandlers();
    }
    protected override void OnLoad(EventArgs e)
    {
        base.OnLoad(e);
        if (!IsPostBack)
        {
            Populate();
        }
    }
    protected abstract void SetEventHandlers();
    protected abstract void Populate();
    protected abstract void OnCancel(object sender, EventArgs e);
    protected abstract void OnSave(object sender, EventArgs e);
}

Answer 1

I'd have to say, with no particular solution, that a good separation of concerns is actually disrupted in the above nested hierarchy. It appears that the functional pieces should be further separated as to not be included every time the other is needed.

Why is it necessary that you have viewstate and validation in the same space? Why not separate it altogether?