Hi Joe, I've had some reports of errors when clicking a button in our custom features after upgrade, and looking at it with error suppression off shows that it's throwing the following exception:

Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that <machineKey> configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.

Before I spend a lot of time researching, I was hoping you might have some ideas off the top of your head about what might have changed in the codeline over the past few months to start causing this. It's going to be tough to debug since the error is thrown before the button click event is firing. No need for a lot of research, but if you have any pointers I'd appreciate it.

Thanks,
Jamie

Hi Joe, I'm still struggling with this one. I spent about four hours on Thursday night trying to get to the bottom of this. I determined it was only happening in cases where viewstate is encrypted (ASP grid viewstate is automatically encrypted by default). To get it working I finally punted by setting

<pages ... viewStateEncryptionMode="Never" ...>

We only have one custom feature that's using viewstate and explicitly encrypting it, so I turned that off temporarily until I could spend more time on the problem (encryption is an extra safeguard for that case but not mission critical).

So today I'm back at it, and I'm thinking I may be seeing the problem shown in this blog post. When I view source for the page with our custom feature, I see that the form element has an action equal to the page URL:

<form method="post" action="/parcel-lookup.aspx" id="aspnetForm">

However, when I have viewStateEncryptionMode set to "Auto" and get the error message, I see the following entries in the detailed error message, which sounds like the problem they describe:

Referer: http://wwwlocal.escondido.org/parcel-lookup.aspx
Path: /Default.aspx

Do you know why this might be happening and how to sync those two up? Also just FYI, there is another page with a delivered poll feature on it that's exhibiting the same issue, so that really gives me some hope that this isn't just something boneheaded I've done within my custom code. Finally, in case it helps, sometimes the error won't fire when I'm logged in, but happens when I'm logged out. Argh!

Thanks,
Jamie

Hi Jamie,

Is there an updatepanel involved in your custom feature?

If so try adding this in PageLoad or something that is called from PageLoad on every request ie both get and poostback requests.

try
{
// this keeps the action from changing during ajax postback
SiteUtils.SetFormAction(Page, Request.RawUrl);
}
catch (MissingMethodException)
{
//this method was introduced in .NET 3.5 SP1
}

You may not need the try catch, I just have that because we support .NET 3.5 sp1 and it throws an error if sp1 is not installed.

Another thing you can try is adding this to user.config:

<add key="UseAjaxFormActionUpdateScript" value="false" />

maybe doing one or both of those will solve it.

The other things to consider is do you really need the viewstate encrypted on the grid? Is there any sensitive data bound to that or any other grids in your site that actually needs to be encrypted? If not then it seems a reasonable solution to turn that off. If there is sensitive stuff shown on the page I would use SSL.

Hope that helps,

Joe

Hi Jamie,

My interpretation of the documentation you linked is that it means if requireSSL is false on the <httpCookies element but true on the <forms element then it will be overridden to true for forms auth cookie, not that it will affect all other cookies when you set it to true on the <forms element. It just means that features that have their own setting for secure cookies will trump this general setting on the httpCookies element.

However we do have our own check in code to force the role cookie to be secure, so we don't really need that setting to ensure the security of the role cookie, so if it is causing other problems I guess we can safely remove that httpCookies setting.

if ((SiteUtils.SslIsAvailable()) && WebConfigSettings.RequireSslForRoleCookie)
{
         roleCookie.Secure = true;
}

Best,

Joe