Viewstate is the process used by an ASP.NET Web page to persist changes to the state of a Web Form across postbacks e.g when a page post's back (such as after a submit button or server control is clicked), when the page reappears the various form fields still contain their data. This is because ASP .NET maintains the page (or view) state via the use of a hidden field placed on each page with a

DotNetNuke has viewstate enabled by default, so module developers should take care to not use unnecessary server controls, or to disable viewstate at the control level, to ensure viewstate does not get too large and impact performance.


Issues with Viewstate»

Viewstate issues can occur if a site is hosting in a webfarm and each webserver does not share the same viewstate keys (i.e. the machinekey validationkey and decryptionkey values). If this is the case an error such as the following can occur: Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that configuration specifies the same validationKey and validation algorithm

By default DNN does not use autogenerate keys, so to rectify this the machinekey node from web.config simply needs to match on other machines. Note, you will still need to ensure your webfarm is using the relevant Caching Providers

This message can occur for a few other reasons:

Note: the 6.0.1 release added some code to catch some of the harmless instances of this and supress the error messages.

Further references



Viewstate encryption is a best practice and a good way to provide an additional level of security (a defence in depth approach). This was enabled as the default for the 5.6.1 release, but is a recommended practice for all versions, to make this change add the viewStateEncryptionMode attribute to the pages node in web.config and set it to Always i.e.

<pages validateRequest="false" enableViewStateMac="true" enableEventValidation="true" viewStateEncryptionMode="Always">


Viewstate optimization»

As part of the DNN 7.3 changes viewstate was optimized in the 7.3.0 release and is now only 92 bytes for anonymous users, and significantly smaller for logged in users.