Solution - Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster

How To Fix the: “Validation of viewstate MAC failed” Error (ASP.NET MVC)

November 23rd, 2009

Goto commentsLeave a comment

I run my site on a Windows Shared Hosting account, and every time I updated the assemblies on my ASP.NET MVC site I’d be presented with the “Validation of viewstate MAC failed” error.

The “Validation of viewstate MAC failed” error only occurred when a page contained an HTML form element that made use of MVC’s AntiForgeryToken. The quick fix was to delete my__RequestVerificationToken cookie, but the error would rear its ugly head the minute I touched my assemblies. The long term solution was to add a machineKey element to my Web.config file – asking visitors to delete a specific cookies when visiting my site was not a viable option.

How I fixed the “Validation of viewstate MAC failed” error on Shared Hosting:

Have you ever needed to generate a MachineKey to use in your application's configuration file or in machine.config? You may need a MachineKey in several scenarios. One of them is the scenario where you deploy your application in a web farm. One another scenario is to need to encrypt Forms Authentication tickets.

You have some options to generate a MachineKey:

• You can build the sample application from the following article: http://support.microsoft.com/kb/312906
• You can search in Bing for "MachineKey generator" and use an online service. Honestly I wouldn't rely on third party online services for generating MachineKey because I wouldn't have any control over them and I couldn't make sure that if they wouldn't log my IP address and MachineKey in a database to use that later - yes, I know it sounds like "paranoia" :)

There is one another way which I have learned from one of my customers today. It was over there waiting in IIS user interface but I never gave it a try before (shame on me). You can use IIS 7.5 user interface to generate the MachineKey section and save it in the web.config of your application / root web.config file. Steps are quite easy:

1) Open IIS manager.

2) If you need to generate and save the MachineKey for all your applications select the server name in the left pane, in that case you will be modifying the root web.config file (which is placed in the .NET framework folder). If your intention is to create MachineKey for a specific web site/application then select the web site / application from the left pane. In that case you will be modifying the web.config file of your application.

3) Double click the Machine Key icon in ASP.NET settings in the middle pane:

4) MachineKey section will be read from your configuration file and be shown in the UI. If you did not configure a specific MachineKey and it is generated automatically you will see the following options:

5) Now you can click Generate Keys on the right pane to generate random MachineKeys. When you click Apply, all settings will be saved in the web.config file.

Oh wait, here’s the error in its entirety for The Google Machine’s crawlers:

Server Error in '/' Application.

Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.

Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.Web.HttpException: Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.