Invalid viewstate error

Answer 1

I would suggest looking at this...it basically outlines some cases where this can happen depending on the doctype. We had a similar issue, and it seemed to only show up erratically...for us it was a conflict between our XHTML doctype and the javascript we had on the page. We were able to solve it by insuring that all of our javascript was correctly wrapped in tags.

<script>
     mycode;
</script>

would become

<script>
// <![CDATA[
    mycode;
// ]]>
</script>

This may not be an identical issue, but if you have an xhtml doctype, look to see if you have unescaped characters that are not legal XML somewhere (such as '<' characters).

Answer 2

This can happen if the machineKey of the app pool that receives the request for scriptresource.axd is different from that of the app pool that served the original page. This is most likely if you're using a web farm. It can also happen on a single server if the app pool restarts, as a new machine key will be generated. The solution to either is to put an fixed machineKey in your web.config.

Answer 3

As said, this might happen if you are using a Web Farm and the machine keys are not in sync.

Another possibility is that the assembly date is in the future. This leads to all sorts of obscure problems and is worth checking. Maybe your server is in a different time zone?

Answer 4

Beska, I went through the code again. & all the js code is inside CDATA tags. I installed IE8 on a separate machine and try to recreate the problem without much luck so far.

Answer 5

I have noticed that the Firefox 3.1 Beta causes invalid viewstate errors. You might want to review your logs to see what browser that is being used when these errors occur.

Answer 6

Hi Matt,

Yes, I reviewed the logs. It's happened to IE8, IE7 & also FF3. So It's hard to believe that it's a browser specific issue. I'm still digging :)

Thanks!

Answer 7

This has become a real pain.. Anyone?

Answer 8

Same error here for User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; AOL 9.0; Windows NT 6.0; Trident/4.0; GTB5; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30618)

I tried modifying/removing doctype declaration and warping the javascript in // <![CDATA[ and there are still exceptions...

For the moment all came from the same IP

Answer 9

<form … autocomplete="off" … />

Answer 10

I'm getting the same errors, they actually just started in the last month or two, its been happening on a couple of our sites and we haven't changed any of them since December. This makes me think a configuration change or windows update is effecting it.

Answer 11

How large is the view state? Some proxy servers will truncate a large view state.

It is easy to abuse viewstate since it is turned on by default. If you do have a large viewstate then you probably want to look into disabling view state on controls that do not need it.

Answer 12

MS recommends not declaring your charset using a meta tag and setting it as a HTTP header instead.

So remove

<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=utf-8">

and add

Response.AddHeader("Content-Type", "text/html; charset=utf-8");

Answer 13

I think these errors happen with different browsers for different reasons, which is what makes it so hard to track down.

IE8 Bug

Microsoft have said a bug in IE8 will (in some circumstances) generate spurious requests to the server, that do not affect the user but do lead to errors being logged at the server side.

See this discussion here: Bug IE8 – 4K dropped - "Invalid viewstate" when loading ScriptResource.axd (edit: link now requires login for some reason, sorry)

... particularly EricLaw-MSFT's update when he says:

It is worth mentioning that anyone who is experiencing a problem here in IE6/IE7 or Firefox is encountering a different problem that is not related to the IE8 issue described below.

This blog post also describes the bugs: Bugs in IE8's Lookahead Downloader

They say changing the way you set Content-Type will help with some of the errors, although not all of them - they say it is caused by various obscure circumstances that they are still looking at.

Update: As of 01/Apr/2010, these IE8 bugs have been fixed, via IE8 Cumulative Update (KB980182).
This post: IE8 Lookahead Downloader Fixed gives more detail on the bugs and other possible/partial workarounds (e.g this one) other than waiting for everyone in the world to download the fix.

Other Browsers

Haven't figured it out yet, but other browsers are also generating these errors, presumably for different reasons.

Web Farms

This problem is not restricted to sites running on web farms, but if you are running a farm, check out this answer by jesal which may help