Security Issues with ViewState
ViewState in ASP.NET can easily be tampered cause the ViewState data is not encrypted. Therefore, please do not store important data or information in ViewState. But if you really need to store the important data in Viewstate, few steps can be used to protect and encrypt the ViewState Data.
1. Enable ViewState Mac in page directives or in the web.config level
<%@Page EnableViewStateMAC=true %>
2. Set the machine.config key by using validation such as 3Des or Sha1. Sha1 is more secured compare to 3Des as it produces a larger hash than MD5 and is cryptographically stronger.
You need to edit your machine.config files like this.
<machineKey validation="3Des" validationKey="AutoGenerate,IsolateApps"/> or <machineKey validation="SHA1" validationKey="AutoGenerate,IsolateApps"/>
If you are running WebFarm on your machine, you cannot use AutoGenerate in your validationKey, hence you must set the same key for all your web farm machine. Otherwise, ViewState generated from one machine could not be POSTed back to a machine farm with different key!. The keys should be 128 characters long(the maximum) and generated totally by random means.
