为什么我只是*在一个服务器环境中随机*获得"viewstate MAC验证失败"？

Question

是的,关于这个特定错误有一百万个问题和线索,有许多记录良好的解决方案,我一定会尝试.但首先我想了解我的特定情况/环境的问题.

在我的情况下,这个错误似乎是完全随机的.我会在几周内没有看到它,然后有一天我会登录我的网站并得到错误.刷新页面,再次登录,没问题.在事件之间的这些时段中,Web服务器没有发生任何特别的特殊情况.

这是另一回事,错误说"如果此应用程序由Web场或群集托管......",但事实并非如此.它只是一个Windows Server 2008.

所以,我理解一般的解决方案是在web.config文件中添加一组静态机器密钥---但为什么这似乎是随机发生的,为什么它发生在我的站点上,它位于单个Windows Server 2008上机？

我正在使用ASP.NET 4,我的站点是在IIS上运行的Web应用程序.

错误信息:

Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that <machineKey> configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.

堆栈跟踪:

[ViewStateException: Invalid viewstate. 
    Client IP: ##::##:##:##:##
    Port: ##
    Referer: http://myserver/login.aspx
    Path: /login.aspx
    User-Agent: Opera/9.80 (Windows NT 6.1; WOW64; U; en) Presto/2.10.289 Version/12.01
    ViewState: /wEPDw...6OCX]

[HttpException (0x80004005): Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that <machineKey> configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.]
   System.Web.UI.ViewStateException.ThrowError(Exception inner, String persistedState, String errorPageMessage, Boolean macValidationError) +235
   System.Web.UI.ViewStateException.ThrowMacValidationError(Exception inner, String persistedState) +14
   System.Web.UI.ObjectStateFormatter.Deserialize(String inputString) +274
   System.Web.UI.ObjectStateFormatter.System.Web.UI.IStateFormatter.Deserialize(String serializedState) +4
   System.Web.UI.Util.DeserializeWithAssert(IStateFormatter formatter, String serializedState) +37
   System.Web.UI.HiddenFieldPageStatePersister.Load() +241
   System.Web.UI.Page.LoadPageStateFromPersistenceMedium() +106
   System.Web.UI.Page.LoadAllState() +43
   System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +8431
   System.Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +253
   System.Web.UI.Page.ProcessRequest() +78
   System.Web.UI.Page.ProcessRequestWithNoAssert(HttpContext context) +21
   System.Web.UI.Page.ProcessRequest(HttpContext context) +49
   ASP.login_aspx.ProcessRequest(HttpContext context) +4
   System.Web.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +100
   System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +75

Answer 1

从您的日志中,我建议您检查一件事 - 您是否已将用户的任何参数与Viewstate连接,如果用户已登录/注销,可以更改该参数？ - 或因任何其他原因而改变,例如因为会话已过期或已更改.

保存和当前Viewstate之间的此参数可能不同,这可能会破坏页面.

例如,此代码可以这样做:

ViewStateUserKey = CurrentUserCookie;

或者这个原样:

ViewStateUserKey = User.Identity.Name

另请阅读此答案:https://stackoverflow.com/a/2551810/159270

这类似: ViewStateUserKey +共享主机+ ViewStateMac验证失败

还有一些参考:http: //www.hanselman.com/blog/ViewStateUserKeyMakesViewStateMoreTamperresistant.aspx
http://msdn.microsoft.com/en-us/library/ms972969.aspx

随机错误是任何开发人员的噩梦.