ASP.NET ViewState Security
ASP.NET ViewState data is stored in a single Base64-encoded string such as this:
id=”__VIEWSTATE” value=”dDw3NDg2NdTI5MDg7Ozr4=”/>
Since this value is not formatted in clear text, developers sometimes assume that their ViewState data is encrypted which is most certainly not the case. This data string can be reverse-engineered this and then viewed. This is an obvious security issue [...]




31. Aug, 2010 by 