You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: support/developer/visualstudio/project-build/troubleshooting-broken-references.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,7 +1,7 @@
1
1
---
2
2
title: Troubleshoot broken references
3
3
description: Learn how to troubleshoot broken references that might be caused by something other than your application's inability to find the referred component.
Copy file name to clipboardExpand all lines: support/developer/webapps/aspnet/performance/troubleshooting-view-state-is-invalid-error.md
+13-13Lines changed: 13 additions & 13 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,7 +1,7 @@
1
1
---
2
2
title: Troubleshoot the invalid viewstate issues
3
3
description: This article describes techniques for debugging and resolving problems with viewstate. Viewstate is a feature of ASP.NET that allows pages to automatically preserve state without relying on server state.
4
-
ms.date: 06/20/2023
4
+
ms.date: 04/17/2025
5
5
ms.reviewer: johnhart, weyao, v-jayaramanp
6
6
ms.topic: troubleshooting
7
7
ms.custom: sap:Performance
@@ -26,16 +26,16 @@ This article describes some techniques that can be used for debugging and for re
26
26
27
27
In a Web farm, each client request can go to a different machine on every postback. Because of this behavior, you can't leave the `validationKey` attribute set to `AutoGenerate` in the *Machine.config* file. Instead, you must set the value of the `validationKey` attribute to a fixed string that is shared by all the machines on the Web farm.
28
28
29
-
## Do not store dynamically generated types in viewstate in a Web farm
29
+
## Don't store dynamically generated types in viewstate in a Web farm
30
30
31
-
When ASP.NET compiles files dynamically, the files are built into assemblies with random names (for example, a file name might be *jp395dun.dll*). If you're running a Web farm, the same files are compiled into assemblies with different random names. Normally, this isn't a problem because no one makes assumptions on those assembly names. But if you ever put a dynamically compiled type into viewstate by using binary serialization, the name of the assembly are included as part of the viewstate data. When that viewstate is later sent to a different server in the Web farm, the viewstate can't be deserialized because it uses different assembly names.
31
+
When ASP.NET compiles files dynamically, the files are built into assemblies with random names (for example, a file name might be *jp395dun.dll*). If you're running a Web farm, the same files are compiled into assemblies with different random names. Normally, it isn't a problem because no one makes assumptions on those assembly names. But if you ever put a dynamically compiled type into viewstate by using binary serialization, the name of the assembly is included as part of the viewstate data. When that viewstate is later sent to a different server in the Web farm, the viewstate can't be deserialized because it uses different assembly names.
32
32
33
33
The best resolution is to avoid using binary serialization. Binary serialization uses many resources even when you don't run into this problem. Instead, limit what you put in viewstate to a combination of arrays, pairs, triplets, and simple types (for example, strings, int, and other types). `System.Web.UI.Pair` and `System.Web.UI.Triplet` are simple wrapper types that the viewstate engine can efficiently process.
34
34
35
35
An alternative fix to avoid this problem is to move the types that you're storing in viewstate into a precompiled assembly, either in your `Bin` folder or in the `Global Assembly` cache. This fix doesn't address performance, but it guarantees that the assembly has the same name on all computers.
36
36
37
37
> [!NOTE]
38
-
> If you store complex data types in viewstate and experience this issue, the call stack information will contain stacks that are similar to the following:
38
+
> If you store complex data types in viewstate and experience this issue, the call stack information contains the following stacks:
39
39
40
40
```console
41
41
[FileNotFoundException: Could not load file or assembly 'App_Web_fx--sar9, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null' or one of its dependencies. The system cannot find the file specified.]
@@ -60,7 +60,7 @@ The purpose of the viewstate machine authentication code (MAC) feature is to mak
60
60
enableViewStateMac="true"
61
61
```
62
62
63
-
The simplest way to determine whether the issue you're dealing with is related to the MAC feature is to turn off the feature. To do this, change the flag in the *Machine.config* file to the following code.
63
+
The simplest way to determine whether the issue you're dealing with is related to the MAC feature is to turn off the feature. To turn off the feature, change the flag in the *Machine.config* file to the following code.
64
64
65
65
```xml
66
66
enableViewStateMac="false"
@@ -71,21 +71,21 @@ If you no longer get viewstate errors, the problem is related to the MAC feature
71
71
> [!IMPORTANT]
72
72
> Only turn off the viewstate MAC feature to help diagnose the problem. You shouldn't keep the viewstate MAC turned off to work around the issue. If you do, you could introduce security holes. For more information, see [Building Secure ASP.NET Applications: Authentication, Authorization, and Secure Communication](/previous-versions/msp-n-p/ff649337(v=pandp.10)).
73
73
74
-
If you turn off the viewstate MAC feature, and then use viewstate for controls that don't HTML encode (for example, a Label control), attackers can tamper with the viewstate data and can put arbitrary data in viewstate. This arbitrary data is decoded and then used by controls when they render the posted page. As a result, attackers can inject script into the application unless you work to prevent the attack. For example, an attacker could decode the data, inject script into the data where a Label control is, and then link to it from a website. Anyone who clicks on the link would be the victim of a script injection attack that could potentially steal their authentication cookies or session ID. The script could also let an attacker alter state data for controls that use viewstate and application specific attacks could occur as a result.
74
+
If you turn off the viewstate MAC feature, and then use viewstate for controls that don't HTML encode (for example, a Label control), attackers can tamper with the viewstate data and can put arbitrary data in viewstate. This arbitrary data is decoded and then used by controls when they render the posted page. As a result, attackers can inject script into the application unless you work to prevent the attack. For example, an attacker could decode the data, inject script into the data where a Label control is, and then link to it from a website. Anyone who select the link would be the victim of a script injection attack that could potentially steal their authentication cookies or session ID. The script could also let an attacker alter state data for controls that use viewstate and application specific attacks could occur as a result.
75
75
76
76
In general, Microsoft recommends that you don't turn off the viewstate MAC feature unless you're confident that you have either disabled viewstate for all controls that don't encode their output (for example, DataGrid controls, DataList controls, Label controls, and other controls) as HTML or that you're always explicitly setting their values on each request to something known to be safe.
77
77
78
78
## Determine exactly what exception occurs when you receive the error message
79
79
80
-
Unfortunately, the invalid viewstate error message that's mentioned in the [Introduction](#introduction) section of this article isn't informative. The error message is caused by some exception being generated when the viewstate is being processed. The problem is that the exception is being consumed, and its details are lost in the error message.
80
+
Unfortunately, the invalid viewstate error message that's in the [Introduction](#introduction) section of this article isn't informative. The error message is caused by some exception being generated when the viewstate is being processed. The problem is that the exception is being consumed, and its details are lost in the error message.
81
81
82
-
By using a debugger, you can determine the original exception. To do this, you must attach a debugger to the ASP.NET process (*Aspnet_wp.exe* or *W3wp.exe*), and then set it to catch all exceptions. The debugger will probably stop at a few exceptions that aren't relevant, but eventually it will hit the viewstate exception and provide useful information for troubleshooting.
82
+
By using a debugger, you can determine the original exception. To do this, you must attach a debugger to the ASP.NET process (*Aspnet_wp.exe* or *W3wp.exe*), and then set it to catch all exceptions. The debugger probably stops at a few exceptions that aren't relevant, but eventually it hits the viewstate exception and provide useful information for troubleshooting.
83
83
84
84
The following steps are an example that uses the Runtime Debugger (*Cordbg.exe*).
85
85
86
86
1. At the command prompt, run the `iisreset` command to make sure you're provided with a good starting point, and then browse to a page on your site.
87
87
1. Run `cordbg.exe`.
88
-
1. Type `<pro>`, and then press **ENTER**. A list of managed processes will appear. You should see either the *Aspnet_wp.exe* or the *W3wp.exe* process. Note its PID.
88
+
1. Type `<pro>`, and then press **ENTER**. A list of managed processes appear. You should see either the *Aspnet_wp.exe* or the *W3wp.exe* process. Note its PID.
89
89
1. Type a `<PID>`.
90
90
91
91
> [!NOTE]
@@ -96,9 +96,9 @@ The following steps are an example that uses the Runtime Debugger (*Cordbg.exe*)
96
96
97
97
## Try storing the viewstate in the session
98
98
99
-
By default, the viewstate is round-tripped with an `<input type=hidden>` field that is sent to the browser. The browser then sends the field back to the server on the next request. In some cases, this viewstate can get large and be a potential source of problems. Some browsers can't handle such a large hidden field (and the resulting large request), and the browsers may truncate the viewstate. Truncating the viewstate causes a "viewstate corrupted" error message. This behavior is most likely to occur in simpler browsers. For example, this behavior may occur in a browser on a PDA.
99
+
By default, the viewstate is round-tripped with an `<input type=hidden>` field that is sent to the browser. The browser then sends the field back to the server on the next request. In some cases, this viewstate can get large and be a potential source of problems. Some browsers can't handle such a large hidden field (and the resulting large request), and the browsers might truncate the viewstate. Truncating the viewstate causes a "viewstate corrupted" error message. This behavior is most likely to occur in simpler browsers. For example, this behavior might occur in a browser on a PDA.
100
100
101
-
To determine whether you may be running into such an issue, try storing the viewstate in the session. The following example demonstrates how to do this.
101
+
To determine whether you might be running into such an issue, try storing the viewstate in the session. The following example demonstrates how to do this.
102
102
103
103
```aspx-csharp
104
104
<%@ language=c# debug=true %>
@@ -126,11 +126,11 @@ void TextChanged(object o, EventArgs e)
126
126
</form>
127
127
```
128
128
129
-
## Determine whether the problem is caused by worker process recycling
129
+
## Determine whether worker process recycling causes the problem
130
130
131
131
Consider the following scenario.
132
132
133
-
- You are running ASP.NET under Microsoft Internet Information Services (IIS) 6.0.
133
+
- You're running ASP.NET under Microsoft Internet Information Services (IIS) 6.0.
134
134
- The application pool is running under an identity other than the Local System account, the Network Service account, or an administrative-level account.
135
135
- The `validationKey` attribute of the `<machineKey>` element is set to `AutoGenerate` in the configuration file.
0 commit comments