Validation of viewstate MAC failed as a result of 3.5 SP1

On the eve of installing the 3.5 SP1 framework on our production IIS servers, I uncovered a problem on our development server. Today I went to use a rather old application 2.0 on DHSIISD1 for a totally unrelated note and found that it was getting a runtime error. The error that was being produced was as follows.

Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.

After spending the past 4 hours trying to determine the root cause, I found that it has to do with the installation of the 3.5 SP1 Framework. How I determined it is what introduced the problem is because I could run the ASP.NET app without error locally on my PC (it also runs in production right now). I then installed the 3.5 SP1 Framework on my PC. After the installation the application running on my PC begin exhibiting the same symptoms. Then I began reviewing what changes were being addressed in the 3.5 SP1. There was a feature put in that allows you to set a form’s Action (HTMLForm.Action) during runtime for example. It is my belief that this is what broke the app. Actually, “broke” is rather subjective. There are a few things to make this stop working.

First, the page in question had controls that caused post backs to occur. The page also had a HTML form defined and the form has an action set.

Because of the HTMLForm.Action change, the form’s action was now being honored where as before, it was not, it was just ignored. As a result, when a control on the form caused a post back, the post back caused the framework to honor the form’s action and route to the confrimpage.aspx. As a result, that page tried to process the viewstate and it was not valid because it came from a different page. Thus, the error being generated. I have read people reporting this as a bug to Microsoft. In their case the symptoms were different. I added to the bug report our experience.

Now, you have to go back to the question of why did a 3.5 SP1 affect a 2.0 application. The bottom line is it should not have (the whole reasoning behind frameworks). But it would appear that 3.5 SP1 does more than just a service pack for the 3.5 framework. It also installs a SP2 for the 2.0 framework. If you look at the MSDN article for the HTMLForm.Action, it says that it is supported in 3.5 SP1, 3.0 SP2, 2.0 SP2. So, it looks to me that they also introduced this feature into the 2.0 SP2 as well. Which by the way is not a distributable you can just download.