How to fix "Validation of viewstate MAC failed.

Introduction:  In this article I will explain the reason and solution to fix to the error “Validation of viewstate MAC failed.

Why this occurs:

If this application is hosted by a Web Farm or cluster, ensure that <machineKey> configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster. View state data that is transferred between the client and the server is always validated to ensure that the ViewState data is not tampered. As the ViewState data is encrypted and decrypted, a unique key is used to encrypt/decrypt this data. When the application is hosted on a single machine, then there is no issue as the key will always be same for both encryption and decryption process. But this will not be the case in web farm because this key value will be different across the servers.

Solution:

There are three solutions to fix this issue:

1.      First Method : is to set the EnableViewStateMac to false in the web.config:

      <system.web>

<pages enableViewStateMac="false">

        .

        .

        .

 </pages>

     </system.web>

2.      Second Method:  is to set the EnableViewStateMac to false at page level as:

<%@ Page EnableViewStateMac="false" Language="C#" AutoEventWireup="true"CodeFile="Default.aspx.cs" Inherits="_Default" %>

But in case of large no of web pages it’s not possible to make changes on every page.

3.      Third Method:  Best and Recommended solution is to specify our own value for encryption and decryption in the web.config file i.e. Machine Key. We can generate the machine key via the Unique Machine KeyGenerator. Below is the sample keys. 

<system.web>

<machineKeyvalidationKey='D3A686722DDE36968147312E2D0EF0F61AC13C1725723317ABE201CE98EF3876E962748E28307308BBA1B4C9E670D52822C8B19E35657725C798FA51E6641F0C'decryptionKey='85C571FEEBFAF94517FAAC3136A29CAAA800033B909EDB52'validation='SHA1'/>

</system.web>

 Generate your own keys and replace the validationKey and decryptionKey with your own unique generated keys.

All methods are useful in solving this problem. But it is recommended to use machine keyin web config file. This is the best solution an less time consuming. Other reason is secutity, because when we set the EnableViewStateMac value to false we expose our application to security threats.