I did some research on this and have tried out inserting:
<machineKey decryptionKey="A4B12CCDD50E95F8GB9GFH6JKAT4Y0U0I2OF2DF2AAFE5AB46189C,IsolateApps" validation="AES" validationKey="480CDF2AS9S9AS5CFDGF0GHFH9JJH4KHKAKLJ2L9F3SAS82A6C16911A29EF48903783F94529C21570AACB72766FB38CD4CE7B85B0ACE3149DC5FC1CCF1AA1CECE3579659996593B06,IsolateApps"/>
as a solution to this error:
Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that <machineKey> configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.
This time I get an error.
HTTP Error 500.19 - Internal Server Error
The requested page cannot be accessed because the related configuration data for the page is invalid.
Then it marks out the line in Config source:
<add name="DemographicDBEntities" connectionString="metadata=res://*/DemoGraph.csdl|res://*/DemoGraph.ssdl|res://*/DemoGraph.msl;provider=System.Data.SqlClient;provider connection string="data source=207.27.57.76,1433;initial catalog=DemographicDB;persist security info=False;user id=west;pwd=westhouseit;multipleactiveresultsets=True;App=EntityFramework"" providerName="System.Data.EntityClient" />
</connectionStrings>
<machineKey decryptionKey="A4B12CCDD50E95F8GB9GFH6JKAT4Y0U0I2OF2DF2AAFE5AB46189C,IsolateApps" validation="AES" validationKey="480CDF2AS9S9AS5CFDGF0GHFH9JJH4KHKAKLJ2L9F3SAS82A6C16911A29EF48903783F94529C21570AACB72766FB38CD4CE7B85B0ACE3149DC5FC1CCF1AA1CECE3579659996593B06,IsolateApps"/>
<system.web>
<compilation debug="true" targetFramework="4.0" />
<customErrors mode="Off"/>
Is the machine key tag well constructed? I put it in a tag all by itself.
I am hosting the application on an online host so I cannot generate any machine code with IIS 7.0. I have raised several tickets to no avail. Thanks for the assistance.
I don't think you can manually specify the key and include the IsolateApps option. It must be Autogenerate,IsolateApps or a specific value without the IsolateApps option.
See the MSDN documentation for details.
I believe what the issue is that IIS doesnt have access to your webconfig file.
Try this out, if it doesnt work take a look at the link below to see if you can try and error your issue.
1.Open control panel
2.Click on” program” link (not uninstall programs)
3.Click” turn windows features on/off” link
4.locate” Internet Information services IIS” in the pop up window and expand its node
5.Expand the” World Wide Web Service” node
6.Expand “Application Development Features” node
7.check the check box of”ASP.NET”
8.Then click ok button
Below is a very interesting link that would help you:
http://support.microsoft.com/kb/942055
Below is a link to a bug report that references Windows 2003 and .Net framework 3.5 and a web garden setup.
Nothing says that the problem is restricted to Win 2003 or even framework 3.5. In a web garden situation, one can imagine that the viewstate errors would happen VERY frequently, not just when the pool recycles (as we experienced).
http://connect.microsoft.com/VisualStudio/feedback/details/412881/net-3-5-installer-breaks-web-gardens-when-used-with-custom-application-pool-identity
To fix the metabase and registry permissions issues, we simply executed the following on our web server:
\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe -ga domain\useraccount
We then recycled the app pool one more time to regenerate the viewstate validation key.
Whether or not this works in your situation will depend on specific details of your situation.
I'm trying to avoid having compile errors block the whole ASP site while we are in development. That is, I want each page to compile on first run instead of the whole site so that compile errors do not show up globally. That can be danged annoying when a dev takes off for lunch after saving with a systnax bleherror.
I've tried adding this to ye olde web config (changed from default "Always"):
<pages compilationMode="Auto" controlRenderingCompatibilityVersion="3.5" clientIDMode="AutoID">
This did not have the desired effect. What can I change in the webconfig or using IIS to disable precompilation?
Web.config
<compilation batch="false" />
Indicates whether batching is supported.
If True, eliminates the delay caused by the compilation required when you access a file for the first time. When this attribute is set to True, ASP.NET precompiles all the uncompiled files in a batch mode, which causes an even longer delay the first time the files are compiled. However, after this initial delay, the compilation delay is eliminated on subsequent access of the file.
The default is True.
https://msdn.microsoft.com/library/s10awwz0.aspx
In IIS 7
To Use the UI
Open IIS Manager and navigate to the level you want to manage. For information about opening IIS Manager, see Open IIS Manager (IIS 7). For information about navigating to locations in the UI, see Navigation in IIS Manager (IIS 7).
In Features View, double-click .NET Compilation.
On the .NET Compilation page, edit settings as necessary.
When finished, click Apply in the Actions pane.
http://technet.microsoft.com/en-us/library/cc725812(v=ws.10).aspx
I'm trying to embed a ChartModule.aspx page within a Default.aspx page using an iframe.
The ChartModule has a button event which updates a chart. The ChartModule has its own ChartsModule.cs.
I'm getting this error:
HTTP Error 500.23 - Internal Server Error An ASP.NET setting has been
detected that does not apply in Integrated managed pipeline mode.Most
likely causes:
•This application defines configuration in the system.web/httpHandlers
section. Things you can try: •Migrate the configuration to the
system.webServer/handlers section. You can do so manually or by using
AppCmd from the command line. For example, from the IIS Express
install directory, run appcmd migrate config "Default Web Site/".
Using AppCmd to migrate your application will enable it to work in
Integrated mode. It will continue to work in Classic mode and on
previous versions of IIS. •If you are certain that it is OK to ignore
this error, it can be disabled by setting
system.webServer/validation#validateIntegratedModeConfiguration to
false. •Alternatively, switch the application to a Classic mode
application pool. For example, from the IIS Express install directory,
run appcmd set app "Default Web Site/"
/applicationPool:"Clr4ClassicAppPool". Only do this if you are unable
to migrate your application.
Detailed Error Information: Module ConfigurationValidationModule
Notification BeginRequest Handler
PageHandlerFactory-Integrated-4.0 Error Code 0x80070032 Requested
URL http://localhost:4161/Default.aspx Physical Path
C:\Documents and
Settings\singhm\Desktop\Temp\Trial2\Trial2\Default.aspx Logon Method
Not yet determined Logon User Not yet determined Request Tracing
Directory
Why is this?
While this may not answer your question directly, here is a thought:
If you have the option, consider turning ChartModule.aspx into a UserControl (ascx), which acts just like another "page" (same lifecycle, its own codebehind file, etc) but integrates more cleanly into an existing aspx page. The above link should be a good introduction to creating and using UserControls.
The error message contains a clue to the solution:
setting system.webServer/validation#validateIntegratedModeConfiguration to false
So make sure the following is present in your web.config:
<validation validateIntegratedModeConfiguration="false"/>
For example:
<configuration>
<!-- your existing settings -->
<system.webServer>
<!-- Add this to here.... -->
<validation validateIntegratedModeConfiguration="false"/>
</system.webServer>
</configuration>
IIS 7 and ASP.NET are quite helpful these days with regard to to error messages and hints contained therein so you should take the time to read them.
I would really recommend using a usercontrol page instead of iframes in asp.net this way you can bind that usercontrol by doing
public override DataBind()
in that you can pass anything into that usercontrol page like refresh data, load certain data, etc..
I have a question and i searched on stack-over flow and found some answer but none of it works for me ,i have a web application it works on the local host but when i host it online it gives me and error that :
<customErrors mode="Off" >
must be off i made that then i gone to use my application it gives me the following one :
Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that <machineKey> configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.
any help will be great ,thanks
You lose security benefits by doing this, but the quickest solution would be to set enableViewStateMac="false" in the web.config.
<pages enableViewStateMac="false" ...>
This can sometimes happen if your ViewState is very large, and you postback before the page has finished loading. If you're using ViewState as a data repository, that's probably why this happens. I would also inspect your markup and make sure that you don't have any unclosed <script> tags.
I am receiving the following error at certain times on asp.net website.
Sys.WebForms.PageRequestManagerServerErrorException:
Validation of viewstate MAC failed.
If this application is hosted by a Web Farm or cluster,
ensure that <machineKey> configuration specifies the
same validationKey and validation algorithm.
AutoGenerate cannot be used in a cluster.
When page refresh goes,no problem.How can I solve this problem?
Microsoft says to never use a key generator web site.
Like everyone else here, I added this to my web.config.
<System.Web>
<machineKey decryptionKey="ABC123...SUPERLONGKEY...5432JFEI242"
validationKey="XYZ234...SUPERLONGVALIDATIONKEY...FDA"
validation="SHA1" />
</system.web>
However, I used IIS as my machineKey generator like so:
Open IIS and select a website to get this screen:
Double click the Machine Key icon to get this screen:
Click the "Generate Keys" link on the right which I outlined in the pic above.
Notes:
If you select the "Generate a unique key for each application"
checkbox, ",IsolateApps" will be added to the end of your keys. I had
to remove these to get the app to work. Obviously, they're not part
of the key.
SHA1 was the default encryption method selected by IIS and if you change it, don't forget to change the validation property on machineKey in the web.config. However, encryption methods and algorithms evolve so please feel free to edit
this post with the updated preferred Encryption method or mention it
in the notes and I'll update.
If you're using a web farm and running the same application on multiple computers, you need to define the machine key explicitly in the machine.config file:
<machineKey validationKey="JFDSGOIEURTJKTREKOIRUWTKLRJTKUROIUFLKSIOSUGOIFDS..." decryptionKey="KAJDFOIAUOILKER534095U43098435H43OI5098479854" validation="SHA1" />
Put it under the <system.web> tag.
The AutoGenerate for the machine code can not be used. To generate your own machineKey see this powershell script:
https://support.microsoft.com/en-us/kb/2915218#bookmark-appendixa
I had this problem, and for me the answer was different than the other answers to this question.
I have an application with a lot of customers. I catch all error in the application_error in global.asax and I send myself an email with the error detail. After I published a new version of my apps, I began receiving a lot of Validation of viewstate MAC failed error message.
After a day of searching I realized that I have a timer in my apps, that refresh an update panel every minute. So when I published a new version of my apps, and some customer have left her computer open on my website. I receive an error message every time that the timer refresh because the actual viewstate does not match with the new one. I received this message until all customers closed the website or refresh their browser to get the new version.
I'm sorry for my English, and I know that my case is very specific, but if it can help someone to save a day, I think that it is a good thing.
This solution worked for me in ASP.NET 4.5 using a Web Forms site.
Use the following site to generate a Machine Key (for example only use secure method in production): http://www.blackbeltcoder.com/Resources/MachineKey.aspx
Copy Full Machine Key Code.
Go To your Web.Config File.
Paste the Machine Key in the following code section:
<configuration>
<system.web>
<machineKey ... />
</system.web>
</configuration>
You should not see the viewstate Mac failed error anymore. Each website in the same app pool should have a separate machine key otherwise this error will continue.
Dear All with all respict to answers up there
there are case gives this error
when web.config value is
<httpCookies httpOnlyCookies="true" requireSSL="true"/>
and link is http not https
On multi-server environment, this error likely occurs when session expires and another instance of an application is resorted with same session id and machine key but on a different server. At first, each server produce its own machine key which later is associated with a single instance of an application. When session expires and current server is busy, the application is redirected like, via load balancer to a more operational server. In my case I run same app from multiple servers, the error message:
Validation of viewstate MAC failed. If this application is hosted by a
Web Farm or cluster, ensure that configuration specifies
the same validationKey and validation algorithm
Defining the machine code under in web.config have solve the problem.
But instead of using 3rd party sites for code generation which might be corrupted, please run this from your command shell:
Based on microsoft solution 1a, https://support.microsoft.com/en-us/kb/2915218#AppendixA
# Generates a <machineKey> element that can be copied + pasted into a Web.config file.
function Generate-MachineKey {
[CmdletBinding()]
param (
[ValidateSet("AES", "DES", "3DES")]
[string]$decryptionAlgorithm = 'AES',
[ValidateSet("MD5", "SHA1", "HMACSHA256", "HMACSHA384", "HMACSHA512")]
[string]$validationAlgorithm = 'HMACSHA256'
)
process {
function BinaryToHex {
[CmdLetBinding()]
param($bytes)
process {
$builder = new-object System.Text.StringBuilder
foreach ($b in $bytes) {
$builder = $builder.AppendFormat([System.Globalization.CultureInfo]::InvariantCulture, "{0:X2}", $b)
}
$builder
}
}
switch ($decryptionAlgorithm) {
"AES" { $decryptionObject = new-object System.Security.Cryptography.AesCryptoServiceProvider }
"DES" { $decryptionObject = new-object System.Security.Cryptography.DESCryptoServiceProvider }
"3DES" { $decryptionObject = new-object System.Security.Cryptography.TripleDESCryptoServiceProvider }
}
$decryptionObject.GenerateKey()
$decryptionKey = BinaryToHex($decryptionObject.Key)
$decryptionObject.Dispose()
switch ($validationAlgorithm) {
"MD5" { $validationObject = new-object System.Security.Cryptography.HMACMD5 }
"SHA1" { $validationObject = new-object System.Security.Cryptography.HMACSHA1 }
"HMACSHA256" { $validationObject = new-object System.Security.Cryptography.HMACSHA256 }
"HMACSHA385" { $validationObject = new-object System.Security.Cryptography.HMACSHA384 }
"HMACSHA512" { $validationObject = new-object System.Security.Cryptography.HMACSHA512 }
}
$validationKey = BinaryToHex($validationObject.Key)
$validationObject.Dispose()
[string]::Format([System.Globalization.CultureInfo]::InvariantCulture,
"<machineKey decryption=`"{0}`" decryptionKey=`"{1}`" validation=`"{2}`" validationKey=`"{3}`" />",
$decryptionAlgorithm.ToUpperInvariant(), $decryptionKey,
$validationAlgorithm.ToUpperInvariant(), $validationKey)
}
}
Then:
For ASP.NET 4.0
Generate-MachineKey
Your key will look like: <machineKey decryption="AES" decryptionKey="..." validation="HMACSHA256" validationKey="..." />
For ASP.NET 2.0 and 3.5
Generate-MachineKey -validation sha1
Your key will look like: <machineKey decryption="AES" decryptionKey="..." validation="SHA1" validationKey="..." />
WHAT DID WORK FOR ME
Search the web for "MachineKey generator"
Go to one of the sites found and generate the Machine Key, that will look like... (the numbers are bigger)
...MachineKey
validationKey="0EF6C03C11FC...63EAE6A00F0B6B35DD4B" decryptionKey="2F5E2FD80991C629...3ACA674CD3B5F068"
validation="SHA1" decryption="AES" />
Copy and paste into the <system.web> section in the web.config file.
If you want to follow the path I did...
https://support.microsoft.com/en-us/kb/2915218#AppendixA
Resolving view state message authentication code (MAC) errors
Resolution 3b: Use an explicit <machineKey>
By adding an explicit <machineKey> element to the application's Web.config file, the developer tells ASP.NET not to use the auto-generated cryptographic key. See Appendix A for instructions on how to generate a <machineKey> element.
http://blogs.msdn.com/b/amb/archive/2012/07/31/easiest-way-to-generate-machinekey.aspx
Easiest way to generate MachineKey - Ahmet Mithat Bostanci - 31 Jul 2012
You can search in Bing for "MachineKey generator" and use an online service. Honestly...
http://www.blackbeltcoder.com/Resources/MachineKey.aspx
my problem was this piece of javascript code
$('input').each(function(ele, indx){
this.value = this.value.toUpperCase();
});
Turns it was messing with viewstate hidden field so I changed it to below code and it worked
$('input:visible').each(function(ele, indx){
this.value = this.value.toUpperCase();
});
This error message is normally displayed after you have published your website to the server.
The main problem lies in the Application Pool you use for your website.
Configure your website to use the proper .NET Framework version (i.e. v4.0) under the General section of the Application Pool related to your website.
Under the Process Model, set the Identity value to Network Service.
Close the dialog box and right-click your website and select Advanced Settings... from the Manage Website option of the content menu. In the dialog box, under General section, make sure you have selected the proper name of the Application Pool to be used.
Your website should now run without any problem.
Hope this helps you overcome this error.
Validation of viewstate MAC failed. If this application is hosted by a web farm or cluster, ensure that <machineKey> configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.
Answer :
<machineKey decryptionKey="2CC8E5C3B1812451A707FBAAAEAC9052E05AE1B858993660" validation="HMACSHA256" decryption="AES" validationKey="CB8860CE588A62A2CF9B0B2F48D2C8C31A6A40F0517268CEBCA431A3177B08FC53D818B82DEDCF015A71A0C4B817EA8FDCA2B3BDD091D89F2EDDFB3C06C0CB32" />
I had this same issue and it was due to a Gridview (generated from a vb code) on the page which had sorting enabled. Disabling Sort fixed my issue. I do not have this problem with the gridviews created using a SQLdatasource.
I am not sure how this happened but I started to get this error in my internal submit form pages. So when ever I submit something I'm getting this error. But the problem is this website is almost working 5-6 years. I don't remember I made an important change.
None of the solutions worked for me.
I have setup a machine key with the Microsoft script and copied into my web.config
I have executed asp.net regiis script.
aspnet_regiis -ga "IIS APPPOOL\My App Pool"
Also tried to add this code into the page:
enableViewStateMac="false"
still no luck.
Any other idea to solve this issue?
UPDATE:
Finally I solved the issue.
I had integrated my angular 4 component into my asp.net website.
So I had added base href into my master page. So I removed that code and it is working fine now.
<base href="/" />
There are another scenario which was happening for my customers. This was happening normally in certain time because of shift changes and users needed to login with different user.
Here is a scenario which Anti forgery system protects system by generation this error:
1- Once close/open your browser.
2- Go to your website and login with "User A"
3- Open new Tab in browser and enter the same address site. (You can see your site Home page without any authentication)
4- Logout from your site and Login with another User(User B) in second tab.
5- Now go back to the first Tab which you logged in by "User A". You can still see the page but any action in this tab will make the error.
Because your cookie is already updated by "User B" and you are trying to send a request by an invalid user. (User A)
<system.web>
<pages validateRequest="false" enableEventValidation="false" viewStateEncryptionMode ="Never" />
</system.web>
I have faced the similar issue on my website hosted on IIS. This issue generally because of IIS Application pool settings. As application pool recycle after some time that caused the issue for me.
Following steps help me to fix the issue:
Open App pool of you website on IIS.
Go to Advance settings on right hand pane.
Scroll down to Process Model
Change Idle Time-out minutes to 20 or number of minutes you don't want to recycle your App pool.
Then try again . It will solve your issue.
I've experienced the same issue on our project. This Microsoft support web page helped me to find the cause. And this solution helped to sort out the issue.
In my case the issue was around ViewStateUserKey as Page.ViewStateUserKey property had an incorrect value (Caused 4 in here). Deleting localhost certificates and recreating them by repairing IIS Expres as mentioned in here fixed the issue.
Thats worked for me
Just add it :
between
system.web section
<system.web>
</system.web>