How can I completly disable ViewState?

[Stan]

Dispite the fact that ViewState="false" at the page level, and all controls
have viewstate disabled, ViewState is still on the page (<input
type="hidden" name="__VIEWSTATE" value="..." />

Why is that?

-Stan

 

[bruce barker]

it stores an encrypted key to verifiy postback matches render and is used to
identify a postback.

-- bruce (sqlwork.com)

 

[Steven Cheng[MSFT]]

Hi Stan,

As for the ViewState problem you mentiond, I agree with Bruce, the ASP.NET
page will store a hash code in the "__VIEWSTATE" hidden field, this hash
code is used to ensure that the view state hasn't been tampered with
between postbacks. We'll talk more about view state hashing in the "View
State and Security Implications" section.
And no matter whether we've disabled the viewstate or not. For detailed
description, you can have a look into the following article:

#Understanding ASP.NET View State
http://msdn.microsoft.com/library/en-us/dnaspp/html/viewstate.asp?frame=true

Regards,

Steven Cheng
Microsoft Online Support

Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)

Get Preview at ASP.NET whidbey
http://msdn.microsoft.com/asp.net/whidbey/default.aspx

 

[Stan]

Excellent article, thank you very much