12

I'm tired of including

EnableViewStateMac="false"

in every page. How to do that globally?

Jader Dias
  • 88,211
  • 155
  • 421
  • 625
  • 7
    For posterity's sake: By disabling ViewStateMAC, you're allowing the ViewState to be tampered with by the client, so you can't really trust any of the data that's in there. – Greg Apr 15 '10 at 13:21
  • 2
    **DO NOT EVER THINK ABOUT THIS AGAIN** [Disabling view state MAC (and why you should never, ever, ever do it)](http://www.troyhunt.com/2013/09/understanding-and-testing-for-view.html) – ebram khalil Mar 10 '14 at 14:17

2 Answers2

23

You can disable it on the <pages> element in the web.config, like this:

<configuration>
  <system.web>
    <pages enableViewStateMac="False" />
  </system.web>
</configuration>
Nick Craver
  • 623,446
  • 136
  • 1,297
  • 1,155
  • 8
    DO NOT DO THIS! This will introduce a security vulnerability into your application (see comment below by @has-altaiar ) and this video: http://vimeo.com/68390507 – Quango Feb 11 '14 at 11:16
7

The answer above explain to you how to set it in the Web.Config, but look at MSDN and you will see what it says here:

This attribute should never be set to false in a production Web site, even if the application or page does not use view state. The view state MAC helps ensure the security of other ASP.NET functions in addition to view state.

Has AlTaiar
  • 4,052
  • 2
  • 36
  • 37