AJAX & Validation of ViewState MAC

Quick post (which apparently has been sitting in my drafts for a few weeks, woops ;-)): ever had an error looking like this when using an AJAX-intensive webapp? 

Validation of viewstate MAC failed.  If this application is hosted by a Web Farm or cluster, ensure that  configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.

or an "Invalid postback or callback argument"-error, coming from the PageRequestManager or ScriptManager?  And you’re not on a Web Farm nor cluster?

In more detail: you get the error ad random, not on all machines, not all the time?  Well, so did we.  As you are well aware, errors that seem to happen at random and only on some machines are quite difficult to debug.  In this case, we had our application installed on a standard W3K-server (virtual server).  When I would surf to the app and use it from my laptop, it worked as it should.  However, when one of my collegues surfed to the same site, she randomly got the above error.

Well, apparently this has got something to do with the ViewState being encrypted: when you encrypt your ViewState, an encrypted ViewState field is added just before the closing of the <form>-tag.  However, when you make a postback before the page is fully rendered, the postback is initiated without this field => thus, throws an error.  You can already imagine why this happens with AJAX (ie, partial postbacks) a bit more often 😉

Solution is easy: in your web.config, in the <pages>-tag, disable EventValidation (enableeventvalidation="false"), and set the encryptionmode to Never (viewstateencryptionmode="Never").  Problem solved!

One quick word of advice: do not do this if you don’t have enough other security checks to make sure your viewstate hasn’t been tampered with (or enough validation to make sure this gets caught later on in the app).  Another way around this is to disable your form on every (partial) postback.