How is viewstate stored

Archived Forums. State Management for ASP. Sign in to vote. User posted Where is viewstate information stored server or client? Wednesday, December 16, AM. User posted Hi, Where is viewstate information stored server or client?

User posted and in which format? User posted check out these links for some help. User posted I had heard that viewstate information is stored in the server. User posted Hi, I had heard that viewstate information is stored in the server.

Because the maximum allowed amount can vary with different firewall and proxy implementations, large hidden fields can cause intermittent problems. If the amount of data that is stored in the ViewState property exceeds the value specified in the page's MaxPageStateFieldLength property, the page splits view state into multiple hidden fields.

This reduces the size of individual hidden fields below the size that firewalls reject. Some mobile devices do not allow hidden fields at all. Therefore, view state will not work for those devices. For more information and alternatives, see ASP. In addition to view state, ASP. NET supports control state. The page uses control state to persist control information that must be retained between postbacks, even if view state is disabled for the page or for a control.

Like view state, control state is stored in one or more hidden fields. You can access view state information by using the page's ViewState property, which exposes a dictionary object. You can use this dictionary to store custom values.

A typical use is to store the value of custom properties that you define in the page. Because view state is sent as a hidden field, you can make changes to view state until the page's PreRenderComplete event. After the page is rendered to the browser, changes to view state will not be saved. The information in the hidden view state field can be seen by users if they view the source of the Web page and can decode base encoded strings. This creates a potential security issue.

For more information about security issues with view state, see Securing View State later in this topic. To save a value to view state, create a new item that contains the value to save and add the item to the view state dictionary. The following example shows an ASP. NET Web page with code that saves a string and an integer value in view state. Custom type converters see the TypeConverter class for more information.

You can store other types of data also, but the class must be compiled with the Serializable attribute so that its values can be serialized for view state. To read a value from view state, you get the ViewState property of page and then read the value from the view state dictionary. The following example shows how you can get an ArrayList object named arrayListInViewState from view state and then bind a GridView control to the object as a data source.

Values in view state are typed as String. In Visual Basic, if you set Option Strict On, you must cast view state values to the appropriate type before you use them, as shown in the previous example.

In C , you must always cast to the appropriate type when you read view state values. If you try to get a value out of view state that does not exist, no exception is thrown. To make sure that a value is in view state, check first whether the object exists. The following example shows how to check for a view state entry. If you try to use a nonexistent view state entry in some other way for example, to examine its type , a NullReferenceException exception is thrown.

By default, view state data is stored in the page in a hidden field and is encoded using base64 encoding. In addition, a hash of the view state data is created from the data by using a machine authentication code MAC key. The hash value is added to the encoded view state data and the resulting string is stored in the page. When the page is posted back to the server, the ASP.

NET page framework re-computes the hash value and compares it with the value stored in view state. If the hash values do not match, an exception is raised that indicates that view state data might be invalid.

By creating a hash value, the ASP. NET page framework can test whether the view state data has been corrupted or tampered with. However, even if it is not tampered with, view state data can still be intercepted and read by malicious users.

The MAC key that is used to compute the view state hash value is either auto-generated or specified in the Machine. If the key is auto-generated, it is created based on the MAC address of the computer, which is the unique GUID value of the network adapter in that computer.

It can be difficult for malicious users to reverse-engineer the MAC key based on the hash value in view state. Thus, MAC encoding is a reasonably reliable way to determine whether view state data has been changed. In general, the larger the MAC key that is used to generate the hash, the less likely it is that the hash value for different strings will be the same. ViewState is stored where you tell it. By default, this is in a hidden field on the page sent to the client.

Save large amount of data in view-state slowdown your site. Use query string to fetch fresh copy from database on each page rather than save whole information from previous page. View State Information stores in hidden fields. Information travels between server and client in this hidden fields. For asp. Where is a ViewState Stored? Is it stored in Server or Client Side?

How can I resolve this?