Invalid viewstate error when posting back to same page

Question

I'm having some issues with an Invalid Viewstate error and I can understand why it's happening but I don't know how to fix it.

I have a page which is similar to this /story/?id=123 but I'm using a different page to Server.Transfer to this page.

So I've set up /info to Server.TransferRequest("/story/?id=123") and it works fine until the page does a postback to itself.

We have a login form on this page which simply reloads the page but when it does it seems to add /?id=123 onto the end of the URL so it ends up like this /info/?id=123 thus causing an Invalid Viewstate error.

I've already tried adding EnableViewStateMac="false" - this fixes the error but it doesn't log the user in as expected so it does not give the required result.

So my questions are:

1. Is there a better way to redirect to my page other than Server.TransferRequest but still keeping the nice URL? - I don't want to Response.Redirect if I can avoid it.

2. If not, is there an easy way to fix this error that doesn't require me adding EnableViewStateMac="false"?

Answer 1

http://support.microsoft.com/kb/316920

I believe that article will explain why you are having the problem and it gives a solution to fix it.

I know you don't want to use Response.Redirect, but I think that would also solve the problem.

PRB: "View State Is Invalid" Error Message When You Use Server.Transfer

This article was previously published under Q316920

Retired KB Content Disclaimer

This article was written about products for which Microsoft no longer offers support. Therefore, this article is offered "as is" and will no longer be updated.

SYMPTOMS

When you use HttpServerUtility.Transfer("page name", true), you receive the following error message:

The View State is invalid for this page and might be corrupted

CAUSE

This problem occurs because the EnableViewStateMac attribute of the <pages> element is set to true by default. When this attribute is set to true, ASP.NET runs a message authentication check (MAC) on the view state of the page when the page is posted back from the client. This check determines if the view state of the page was modified on the client. For security purposes, it is recommended that you keep this attribute set to true.

When you call the Server.Transfer method and set the second parameter to true, you preserve the QueryString and the Form collections. One of the form fields is the hidden __VIEWSTATE form field, which holds the view state for the page. The view state message authentication check fails because the message authentication check only checks each page. Therefore, the view state from the page that calls Server.Transfer is not valid on the destination page.

View state is page scoped and is valid for that page only. View state should not be transferred across pages.

RESOLUTION

To resolve this problem, use one of the following methods.

Resolution 1

Transfer values between pages to pass your server control values to the other pages. For more information, refer to the following MSDN documentation: Passing Server Control Values Between Pages This requires that you create public properties for each property of a control that you want to access from the destination page.

If you have many controls, and if you want to access the properties of these controls from another page, you can also declare those controls as public variables. For example:

Page1.aspx

Public Class Page1
    Public WithEvents TextBox1 As System.Web.UI.WebControls.TextBox

    'Insert your code here.
End Class

Page2.aspx

Dim sourcePage As Page1
sourcePage = CType(Context.Handler, WebForm1)
Response.Write(sourcePage.TextBox1.Text)

Resolution 2

Do not pass the second parameter (which is false by default) when you call Server.Transfer. For example:

Server.Transfer("<page name>")

This code does not send the QueryString and the Form fields to the page that is called. When no data is transferred, ASP.NET does not run the message authentication check.

MORE INFORMATION

Steps to Reproduce the Behavior

1. Create an .aspx page named WebForm1.aspx that transfers execution to another page. Add the following code to WebForm1.aspx:

   <%@ Page language="vb" AutoEventWireup="true" %>
   
   <html>  
     <body>  
       <form id="WebForm1" method="post" runat="server">
         <asp:TextBox id="txtName" runat="server">Your Name</asp:TextBox><br>
         <asp:Button id="Button1" runat="server" Text="Submit" OnClick="Button1_Click"></asp:Button>
       </form>   
     </body>
   </html>
   
   <script runat=server>
   Sub Button1_Click(sender As Object, e As System.EventArgs)
     Server.Transfer("WebForm2.aspx",true)
   End Sub
   
   </script>
   

2. Create another .aspx page named WebForm2.aspx, and then add the following code:

   <%@ Page language="vb" AutoEventWireup="true" %>
   
   <html>
     <body>  
       <form id="WebForm2" method="post" runat="server">
         <asp:Label id="lblName" runat="server" >Web Form 2</asp:Label>
       </form>
   
     </body>
   </html>
   
   <script runat=server>
   Sub Page_Load(sender As Object, e As EventArgs)
   
   Dim thisPage As System.Web.UI.Page
   Dim nameTextBox As TextBox
   
     thisPage = CType(Context.Handler, System.Web.UI.Page)
     nameTextBox =  CType(thisPage.FindControl("txtName"), System.Web.UI.Control)
   
     lblName.Text = "Your name is '" & nameTextBox.Text & "'."   
   
   End Sub
   
   </script>
   

3. Open WebForm1.aspx in your browser, and then click Submit.