CODEWITHSUNDEEP
asp.netencryptionwebformsviewstate
Learning
Learning

Reputation: 20011

How to encrypt Viewstate properly in asp.net webform

I am using asp.net webform website which is using 4.5 framework and vunrability scanner show viewstate as Unencrypted __VIEWSTATE parameter

Even though i am using machine key it still flags it

 <machineKey validationKey="xxxxxxxxxxxx" decryptionKey="xxxxxxxxxxxx" validation="SHA1" decryption="AES" />

Is this how viewstate can be encrypted in asp.net webform 4.5

Upvotes: 3

Views: 11120

Answers (1)

VDWWD
VDWWD

Reputation: 35544

You can set the ViewState encryption in the pages node under system.web of the Web.Config.

<system.web>  
  <pages viewStateEncryptionMode="Always" />  
</system.web>

More info: https://learn.microsoft.com/en-us/dotnet/api/system.web.ui.page.viewstateencryptionmode?redirectedfrom=MSDN&view=netframework-4.7.2#System_Web_UI_Page_ViewStateEncryptionMode

Upvotes: 5

Related Questions