ASP.Net - Hack viewstate and postback

Posted on 2009-05-01
Last Modified: 2012-05-06
I'm sure we can see what is inside view state in client site.

But could hacker alter the data stored in view state and post back to server?

For example, I store ID in view state and display information regarding that ID. Then user (hacker) changes ID to some ID and post back to server.

If so, could I please get some solid examples about how to prevent them? Thank you so much for help!!!
Question by:winmyan
    LVL 9

    Expert Comment

    Viewstate is hashed but breakable. Use viewstate encryption as described in

    Author Comment

    Hi tillgeffken,

    Thank you for your quick response.

          <pages ViewStateEncryptionMode="Always" />

    Just by doing that view state in all aspx pages will be encrypted. Mainly, no hacker can alter the view state?
    LVL 9

    Accepted Solution

    That's correct. At least it will make it very difficult, nothing is impossible. However this is not the right approach to hide data from users. Your website's security should make sure that content is only served to authorized users but that's a totally different story.

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Do You Know the 4 Main Threat Actor Types?

    Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

    Sometimes in DotNetNuke module development you want to swap controls within the same module definition.  In doing this DNN (somewhat annoyingly) swaps the Skin and Container definitions to the default admin selections.  To get around this you need t…
    Problem Hi all,    While many today have fast Internet connection, there are many still who do not, or are connecting through devices with a slower connect, so light web pages and fast load times are still popular.    If your ASP.NET page …
    In this sixth video of the Xpdf series, we discuss and demonstrate the PDFtoPNG utility, which converts a multi-page PDF file to separate color, grayscale, or monochrome PNG files, creating one PNG file for each page in the PDF. It does this via a c…
    Internet Business Fax to Email Made Easy - With eFax Corporate (, you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…

    761 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    13 Experts available now in Live!

    Get 1:1 Help Now