Security for Viewstate in asp.net

While working with viewstate, the main concern in security. The data stored in view state is not secure. The main reason behind this is, hidden fields used to store data. It means data will be on client side. So data on client side is not secure. Hackers can easily steal data from there. But we can make data secure on client side by using different methods.

There are two different method by using them we can make data secure.

1.      We can do it by adding EnableViewStateMac="true" with page directive.

EX.

<%@ Page Language="C#" AutoEventWireup="true" EnableViewState="true"EnableViewStateMac="true" %>

2.      Encrypt the data by adding ViewStateEncryptionMode with page directive. There are three options with it:

·          Always: it encrypt the data always

·          Never: It never encrypts the data.

·          Auto: It encrypts the data if any control request for it

<%@ Page Language="C#" AutoEventWireup="true" EnableViewState="true"EnableViewStateMac="true" ViewStateEncryptionMode="Always" %>