ViewState MAC Validation errors in TMEditor

If you’ve used TMEditor on Windows 2003 you may have experienced the following error when using TMEditor:

Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.

There are several reasons why this may happen; however there is a general way around this problem which is to disable ViewState MAC validation. To do this edit the TMEditor’s web.config file and add the following as a child of the system.web section:

<pages enableEventValidation="false" viewStateEncryptionMode="Never" enableViewStateMac="false" />

However please note that this may allow attacks on the application or IIS on a public-facing server; however if you’ve got TMEditor sitting unprotected on an internet connection then you’re already in trouble :-).

The following references provide more information:

http://forums.asp.net/t/955145.aspx?PageIndex=9 - ASP.NET forum post
http://msdn2.microsoft.com/en-us/library/aa302426.aspx - Building Secure ASP.NET Pages and Controls (MSDN).