0

There is a warning in the @Page directive regarding the EnableViewStateMac setting found here that states:

"Security Note This attribute should never be set to false in a production Web site."

This warning seems unconditional, regardless of the Page ViewState setting (true or false). Does this warning apply to @Pages that have EnableViewState set to false? If the warning does apply in this case, why, when ViewState is turned completely off for the page and its child controls, is this a concern?

Upgate: The warning seems to apply, being that some doofus could drop a control that uses Control State on to a page that has ViewState = false AND ViewStateMac = false.

1 Answer 1

4

If there's no viewstate there's no harm in leaving it on ... and, remember, there are cases where, despite your best attempts viewstate may sneak in, under the guise of control state, so the warning still applies.

1
  • That was my next question - because Control State still uses StateBag. Could be me, but this seems absolutely bizarre; some knucklehead has the ability to drop a control using Control State on a page that has ViewState = false and ViewStateMac = false. There should be a way to absolutely disable ViewState on a page completely, sealing it. Oh well.
    – gangelo
    Jul 27, 2011 at 9:22

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.