View State

如何查看viewstate

鼠标右键页面，然后view page source

源码中搜索viewstate，会找到一个隐藏的字段。

<input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" value="/wEPaA8FDzhkNmJlYWE3ODdlY2ZhMxgFBRpjdGwwMCRjcGhNYWluJHVjUHJvZmlsZSRJZA8FATVkBSBjdGwwMCRjcGhNYWluJHVjUHJvZmlsZSRMYXN0TmFtZQ8FA+WNomQFG2N0bDAwJGNwaE1haW4kdWNQcm9maWxlJEFnZQ8FAjMyZAUhY3RsMDAkY3BoTWFpbiR1Y1Byb2ZpbGUkRmlyc3ROYW1lDwUG5L+K5rabZAUdY3RsMDAkY3BoTWFpbiR1Y1Byb2ZpbGUkTW9uZXkPBQwwLjAwMDAwMjU1MjBkq9Xg7eCkuRMKxXAWft9MqgH5A1AKB7Ai3JQcgVlh+OI=" />

还有可能搜到一个叫__VIEWSTATEGENERATOR的字段，不过这个不是viewstate

<input type="hidden" name="__VIEWSTATEGENERATOR" id="__VIEWSTATEGENERATOR" value="8EB90039" />

F12，然后在elements菜单中进行搜索

 

解密

通过这个页面，可以进行解密http://viewstatedecoder.azurewebsites.net/

需要注意是有可能只能部分解密

32 byte(s) left over, perhaps an HMACSHA256 signature?

 

浅谈ViewState

一、ViewState概述
① ViewState是基于webform的

② 在web窗体控件属性处设置runat = "server",这个控件会被附加一个隐藏的属性_ViewState，_ViewState存放了所有控件在ViewState中的状态值。

③ 页面会在输出时，自动添加下面的隐藏域：

value处的值只是base64编码并不是加密。

④ ViewState是一个名称/值的对象集合。

⑤ 当请求某个页面时，ASP.NET会把所有控件的状态序列化成一个字符串，然后作为窗体的隐藏属性送到客户端，当客户端将页面回传时，ASP.NET分析回传的窗体属性，并赋给控件对应的值。（恢复现场）

⑥ ViewState不能存储所有的数据类型，仅支持：String、Integer、Boolean、Array、ArrayList、Hashtable

 

防止篡改

How to Make ViewState Secure in ASP.NET

 

 

Understanding ASP.NET View State

ASP.NET View State Overview

 

 

What Is View State And How It Works In ASP.NET

Background 

A web application is stateless.

That means that a new instance of a page is created every time when we make a request to the server to get the page and after the round trip our page has been lost immediately.

It only happens because of one server, all the controls of the Web Page is created and after the round trip the server destroys all the instances. So to retain the values of the controls we use state management techniques.

 

State Management Techniques

 

They are classified into the following 2 categories,

 

 

Now I am explaining what View State is.

 

View State

 

View State is the method to preserve the Value of the Page and Controls between round trips. It is a Page-Level State Management technique. View State is turned on by default and normally serializes the data in every control on the page regardless of whether it is actually used during a post-back.

 

Now I am showing you an example of what the problem is when we don't use view state.

    //Declaration of a and b  
    public string a, b;  
    protected void Button1_Click(object sender, EventArgs e)  
    {  
        //TextBox1 and TextBox2 Value is Assigning on the variable a and b  
        a = TextBox1.Text;  
        b = TextBox2.Text;  
        //after clicking on Button TextBox value Will be Cleared  
        TextBox1.Text = TextBox2.Text = string.Empty;  
    }  
       
    protected void Button3_Click(object sender, EventArgs e)  
    {  
        //value of variable a and b is assingning on TextBox1 and Textbox2  
        TextBox1.Text = a;  
        TextBox2.Text = b;  
    }   

 

It only happens because all the controls are classes and on the server all the Control Objects are created and then after the round trip the Page is returned to the client's browser in HTML format and the objects are destroyed at the server.

 

After the Submit button is clicked the value of user name and password is submitted to the server.

We cannot restore the value again because after the postback the instance of the control is destroyed and on clicking of the Restore Button the server takes a new request and the server cannot restore the value of the TextBox.

 

 

Features Of View State

 

These are the main features of view state,

1. Retains the value of the Control after post-back without using a session.
2. Stores the value of Pages and Control Properties defined in the page.
3. Creates a custom View State Provider that lets you store View State Information in a SQL Server Database or in another data store.

And now I am explaining the stored value in the View State and the remaining steps are the same as the previous.

    protected void Button1_Click(object sender, EventArgs e)  
    {  
        //Value of Textbox1 and TectBox2 is assigin on the ViewState  
        ViewState["name"] = TextBox1.Text;  
        ViewState["password"] = TextBox2.Text;  
        //after clicking on Button TextBox value Will be Cleared  
        TextBox1.Text = TextBox2.Text = string.Empty;  
    }  
    protected void Button3_Click(object sender, EventArgs e)  
    {  
        //If ViewState Value is not Null then Value of View State is Assign to TextBox  
        if (ViewState["name"] != null)  
        {  
            TextBox1.Text = ViewState["name"].ToString();  
        }  
        if (ViewState["password"] != null)  
        {  
             TextBox2.Text = ViewState["password"].ToString();  
        }  
    }    

After clicking on the Submit Button the value of user name and password is submitted in View State and the View State stores the value of user name and password during post-back.

 

After click on the Restore Button we can get the value again. The Value must be retained during post-back and the values are stored into a base 64 encoded string and this information is then put into the View State Hidden Field.

Data Objects That Can be Stored in View state

1. String
2. Boolean Value
3. Array Object
4. Array List Object
5. Hash Table 
6. Custom type Converters

Advantages of View State

1. Easy to Implement.
2. No server resources are required: The View State is contained in a structure within the page load.
3. Enhanced security features: It can be encoded and compressed or Unicode implementation.

Disadvantages of View State

1. Security Risk: The Information of View State can be seen in the page output source directly. You can manually encrypt and decrypt the contents of a Hidden Field, but It requires extra coding. If security is a concern then consider using a Server-Based state Mechanism so that no sensitive information is sent to the client.
2. Performance: Performance is not good if we use a large amount of data because View State is stored in the page itself and storing a large value can cause the page to be slow.
3. Device limitation: Mobile Devices might not have the memory capacity to store a large amount of View State data.
4. It can store values for the same page only.

When We Should Use View State

1. When the data to be stored is small.
2. Try to avoid secure data.