WebResource.axd - Invalid ViewState

Question

I keep seeing these errors in our error log. Any ideas how i can figure out where its coming from, or better yet how to fix the problem?

System.Web.HttpException: Invalid viewstate. at System.Web.UI.Page.DecryptString(String s) at System.Web.Handlers.AssemblyResourceLoader.System.Web.IHttpHandler.ProcessRequest(HttpContext context) at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)

Update Here is what I have tried so far - we are running a single web server (no farm)

• Adding a Machine Key value to web.config

Answer 1

That looks like the error you get when the viewstate can't be decoded - if a request is submitted with someone else's viewstate.

You can duplicate it by recording an asp.net page with wget. Bring that locally saved page up in your browser and click on a link. When it goes to the server, it will try and fail to decode the viewstate in the saved page and you'll see that error.

I ran across this when I was doing some anti-phishing stuff.

Answer 2

MS has an open bug report as of 6/14/09 reguarding this issue:

https://connect.microsoft.com/VisualStudio/feedback/ViewFeedback.aspx?FeedbackID=434997&wa=wsignin1.0

Answer 3

I had this problem when Google (and other search spiders) indexed one of my sites. I had to place in /robots.txt that the webresource.axd files had to be ignored, and the error stopped since.

We are using ELMAH, so we were able to see the browser version that requested the file, and it ended being GoogleBot.

Answer 4

I am having the exact same problem. The bug confirmed by MS (https://connect.microsoft.com/VisualStudio/feedback/ViewFeedback.aspx?FeedbackID=434997&wa=wsignin1.0) make sense however, MS claims this is an IE8 issue but I find that users with any version of IE (6,7 & 8) are having this problem.

No Firefox users are experiencing it so it seems to confirm it is a MSIE issue.

Answer 5

I've added the Response headers (ContentType and CharSet) that Microsoft suggested, but still these errors keep coming in. Thankfully it doesn't appear to make any difference to the end-user, but it's driving me batty seeing these errors in the log.

Answer 6

Update: Microsoft announced that the following bug fix for IE 8 fixes this problem:
http://blogs.msdn.com/ieinternals/archive/2010/04/01/IE8-Lookahead-Downloader-Fixed.aspx