Invalid postback or callback argument / Invalid viewstate

2
votes

We have asp.net (v3.5) website running on IIS 7.5 our application pool is in 2.0. The site is also on a Load Balance Server Farm with sticky sessions. On average we get about 200 to 300 viewstate errors a day, and postback errors are 1,000 to 2,000 a day.

The pages that have the most postback errors contain an asp datalist which have many items bound to it. Along with dropdowns for filtering and paging, and some asp hyperlinks that postback.

For the viewstate those pages use ajax tabs, asp hyperlinks, a modal popup extender, and a asp drop down.

The site does get a good amount of traffic to it, and has many bots such as Google and MSN hitting it.

We have tried the following:

  • Disabling viewstate on certain controls to minimize the viewstate size
  • Moving the viewstate into the database
  • Compressing the viewstate
  • Moving the viewstate to the bottom of the page

None of the above has helped us with our problem.

Any help in troubleshooting this problem would be much appreciated thank you.

Updated with Error Info:

  • Viewstate

Error Source: System.Web

Error Try/Catch: System.Web.UI.ViewStateException: Invalid viewstate. Client IP: ... Port: *** User-Agent: Mozilla/4.0 (compatible; Synapse) ViewState: 00ytitesern5vnudvqgz rneo/nncjwe2gqvm9hwsejfneaemuijx m43rkjqdgmurhezuvzjtw fcu/cbzrx0xfscog4bv07c1fi7ali/883amvbby5owiliaihufk4fvbn1wgarkbwxmmionsf0jcgw6wlnppj3ww8nmd3 423pu91yexxuyuygxpnu9osgzvxre5wfjlhlhg4ngo1bxdgekgfilzqbxjq58w2aqc7gvdj1ytz4xshkzvjdldiecewgfokt/ot2cpecb bavgiy2f/lvfjg4h9kmuvumsgrbkc6enfnfa0eqce2fi2hj3jo1qqchwsvty8l9uaq6k8oq6ctsggrtyr3xnd 654w6nmldj w8 u vvbaez6hm5zofqxnfrzobik6qbqq5dd7qrozuiu abdvgg xaa5jjm9o5/rroxkrx2fzzhkzjij0xc9p6jenvht 0mplciq4xnewyotosx86axuioyb0yww2phkothy2zok7j2q/ xz4j29zz2drnmqj1km 3j mofii0kk0qe0/s8mkotmhtk4k rfyfja/h7wtebpualg3hg9ydru3yn6pfimay2aasoloydvmj/xfffd tknfqeg7da7/n2flq6hczcolanyjsxf9ofstomby4flhcyuuq/hqg7pc8qvrqy0s/seqyqkr 1ne7bktrazjwlgygpprawneml8f1kbujtbjtz7feieyzu76j1mnt agwlrhgchwjmux58cjlu2bbh7ayitfevapzt21pn92du5zcnmiajfxfou1motqkl8hqmlbjj0hxhpi5j5gg5xdxpz5xkqfdflw2wgqvfjxilhqm6mwyjsmif6r8wtdjkrsxxmapyeq61lfa8 7zntc2v3v8rup1kgm0ssp7bb zgcfy...

Error Info: Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that |machineKey| configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.

HttpErrorCode: 500

Stack trace: at System.Web.UI.ViewStateException.ThrowError(Exception inner, String persistedState, String errorPageMessage, Boolean macValidationError) at System.Web.UI.ObjectStateFormatter.Deserialize(String inputString) at System.Web.UI.Util.DeserializeWithAssert(IStateFormatter formatter, String serializedState) at System.Web.UI.HiddenFieldPageStatePersister.Load() at System.Web.UI.Page.LoadPageStateFromPersistenceMedium() at System.Web.UI.Page.LoadAllState() at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) at System.Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) at System.Web.UI.Page.ProcessRequest() at System.Web.UI.Page.ProcessRequest(HttpContext context) at ASP.content_aspx.ProcessRequest(HttpContext context) at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)

Browser: Mozilla/4.0 (compatible; Synapse)

  • Postback Error Source: System.Web

Error Try/Catch: System.ArgumentException: Invalid postback or callback argument. Event validation is enabled using |pages enableEventValidation=|true|/| in configuration or |%@ Page EnableEventValidation=|true| %| in a page. For security purposes, this feature verifies that arguments to postback or callback events originate **_sQueEl_clean the server control that originally rendered them. If the data is valid and expected, use the ClientScriptManager.RegisterForEventValidation method in order to register the postback or callback data for validation. at System.Web.UI.ClientScriptManager.ValidateEvent(String uniqueId, String argument) at System.Web.UI.WebControls.TextBox.LoadPostData(String postDataKey, NameValueCollection postCollection) at System.Web.UI.Page.ProcessPostData(NameValueCollection postData, Boolean fBeforeLoad) at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)

Error Info: Exception of type |System.Web.HttpUnhandledException| was thrown.

HttpErrorCode: 500

Stack trace: at System.Web.UI.Page.HandleError(Exception e) at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) at System.Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) at System.Web.UI.Page.ProcessRequest() at System.Web.UI.Page.ProcessRequest(HttpContext context) at ASP.category_aspx.ProcessRequest(HttpContext context) at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)

Browser: Mozilla/5.0 (iPhone; CPU iPhone OS 6_0_1 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A523 Safari/8536.25

2
c#asp.netiis-7.5
Chances are your datasource for your datalist is being databinded to something different than before the postback. An alternative solution is to use ajax instead of relying on postbacks. Other than that, we need more specific information. – Brad M
@Brad thank you what other information could I provide you with? – Kaos
Could you post the exact errors that you're receiving? May help us diagnose the problem. – Grant Clements
@GrantClements I've updated the post with the errors we get – Kaos

2 Answers

1
votes

Are the machine key (http://msdn.microsoft.com/en-us/library/w8h3skw9%28v=vs.71%29.aspx) values on all servers in the farm the same?

0
votes

I've seen similar issues, and on investigation we were able to conclude that this is caused by spambots hitting our site - ie attempting to submit values without first having obtained the correct viewstate, and the viewstate is doing exactly what it is designed to do (protect your postbacks from invalid data - malicious or otherwise).

This is likely what you're seeing too, I expect. If you're getting many bots such as Google and MSN hitting it, it's almost certain you're getting bad bots too.

Refer to these SO search results: https://stackoverflow.com/search?q=asp.net+spambot

And articles like this one might help alleviate your concerns about the error.

It does strike me as odd that the error message sends us on a wild-goose-chase trying to detect complex internal problems, rather than just explicitly stating something along the lines of "in the wild, the simplest and most likely cause of this scenario is that you have been hit by a spambot" with some recommendations or articles to refer to advising how to confirm this.