ViewState, EnableViewStateMAC and two IP addresses in one session

[Tony Stiles]

Hi.

I am running an ASP.NET app that is using ViewState.

Everything is fine apart from an issue with viewstate.
Is the client IP address taken into account in encrypting viewstate?

Here is my scenario. Connect to internet. Obtain IP address. Log in to
site. Use site. Get to a page that contains viewstate. Do a postback.
Refresh page. Fine. Now disconnect and reconnect to get a new IP
address. Refresh page. Viewstate error. Problem does not occur if page
has no viewstate or is not postback.

My basic question is : can I enableviewstatemac and allow my end user
to swap his IP address in the middle of a session? This is a valid
situation - for example if a connection to the internet is lost and
the client has to dialup again to continue his task (without closing
his browser window).

Many thanks for listenning and for any responses.

Tony

 

[Matt Hooper]

Hi Tony,

I was researching a "ViewState is invalid" error and came across your
post. I do not believe that changing your IP address will affect the
verification based on a test I've performed.

The test was as follows:

1) Create a simple ASPX page
2) Load the page in a web browser on Computer A
3) Save HTML source to a file
4) Add a <base href=""> to the source to point to Computer A
5) Open saved HTML in web browser on Computer B
6) Click a button on the page that performs a post back to Computer B

Step 6 should fail if the IP address was being verified, however things
seemed to work fine for me. Also, I should say I verified that
enableViewStateMAC was set to true in machine.config and was not
overridden in the site's web.config.

Matt Hooper