Asp.net ViewState Security
Asp.net ViewState Security. ASP.NET ViewState data is stored in a single Base64-encoded string such as this: id="__VIEWSTATE" value="dDw3NDg2NdTI5MDg7Ozr4="/> Since this value is not formatted in clear text, developers sometimes assume that their ViewState data is encrypted which is most certainly not the case. This data string can be reverse-engineered this and then viewed. This is an obvious security issue if sensitive data is being stored in ViewState. To make ViewState secure, there are two choices, hash codes and ViewState encryption. USE A HASH CODE. A hash code is a cryptographically strong checksum. When you use a has code, ASP.NET calculates the checksum based on the current ViewState content data and then adds this to the hidden input field when the page when is returned to the client. On the page post back, ASP.NET then recalculates the checksum to ensures a match. If a malicious user were to change the...