ViewState, Firewalls, and MaxPageStateFieldLengt h

[Simpson, Nick]

Thanks for the code sample Mark. Not sure how this compares to the
MaxPageStateFieldLength of .NET 2.0. which seems to have some unfortunate
consequences like ViewState errors. Guess if you roll your own you have more
control.

-----Original Message-----
From: Discussion of building .NET applications targeted for the Web
[mailto:DOTNET-***@DISCUSS.DEVELOP.COM] On Behalf Of Mark Kucera
Sent: 10 May 2007 18:44
To: DOTNET-***@DISCUSS.DEVELOP.COM
Subject: Re: [DOTNET-WEB] ViewState, Firewalls, and MaxPageStateFieldLength

Yes absolutely, Firewalls can truncate viewstate if the field length is too
long. The work around isn't necessarily to limit the viewstate (although I
would recommend making this as small as possible something like datagrid
sorting / paging doesn't work so well with it turned off
:) ), instead you break the viewstate up into several fields. This is
actually pretty simple, and I've been using it for at least 5 years in all
my ASP.NET projects.

Just add these overrides to your base page class...

#region Modified ViewState Code
protected override object LoadPageStateFromPersistenceMedium()
{
LosFormatter format = new LosFormatter();
int cnt = 0;
try
{
Cnt = Convert.ToInt32(Request["__VIEWSTATE0"].ToString());
}
catch (System.NullReferenceException)
{}
catch (System.FormatException)
{}

System.Text.StringBuilder s = new
System.Text.StringBuilder();
for ( int i = 1; i <= cnt; i++ )
try
{
s.Append( Request["__VIEWSTATE" +
i.ToString()].ToString() );
}
catch (System.NullReferenceException)
{}

try
{
object o = format.Deserialize(s.ToString());
if (o.GetType() == typeof(Triplet))
return o;
else if (o.GetType() == typeof(string) && (o as
string).Length == 0)
o = null;
return o;
}
catch (System.Exception)
{
}
}

protected override void SavePageStateToPersistenceMedium(object
viewState)
{
LosFormatter format = new LosFormatter();
System.IO.StringWriter writer = new System.IO.StringWriter();
format.Serialize(writer, viewState);
System.Text.StringBuilder s = new
System.Text.StringBuilder(writer.ToString());
int cnt = 1;
int left = s.Length;

while( left > 0 )
{
int cut= (left > 1000) ? 1000 : left; //Change 1000 to
whatever size you need
RegisterHiddenField("__VIEWSTATE" + cnt.ToString(),
s.ToString().Substring(0,cut));
S = s.Remove(0,cut);
left -= cut;
cnt++;
}
cnt--;

RegisterHiddenField("__VIEWSTATE0", cnt.ToString());
}
#endregion

Good Luck
-Mark

-----Original Message-----
From: Discussion of building .NET applications targeted for the Web
[mailto:DOTNET-***@DISCUSS.DEVELOP.COM] On Behalf Of Nick Simpson
Sent: Thursday, May 10, 2007 10:25 AM
To: DOTNET-***@DISCUSS.DEVELOP.COM
Subject: [DOTNET-WEB] ViewState, Firewalls, and MaxPageStateFieldLength

Hi There,

A very small number of the users on our web sites (using .NET 1.1 or .NET
2.0) complain that the sites hang for them when they click buttons/links
that trigger postbacks. Some of these buttons are LinkButtons, some are
ImageButtons, some use Javascript, some do not. They are all unusable.

When i first heard about this i created some basic tests on our site to
check that HTTP POSTs were working in general for these users and they are.
In fact basic Web Forms outside of the context of our normal pages work
fine. Both LinkButtons and ImageButtons trigger successful postbacks without
hanging.

One of the main things that distinguishes these pages is the size of the
ViewState. The postbacks that worked had very small ViewState - approx. 50
characters. Our homepage on the other hand ViewState accounts for 20K of the
80K file size.

I hear some firewalls can block HTTP POSTs with large ViewState so i have
cut down the size of our ViewState and also used the MaxPageStateFieldLength
setting in web.config.

Has anyone out there had Firewall issues with ViewState? Is there any bullet
proof way of ensuring firewalls don't block it short of not using it?

Also does anyone else have experience of using MaxPageStateFieldLength? It
seems to have the unfortunate side effect for us of producing a small but
steady trickle of ViewState errors with error messages like "Invalid
viewstate: Missing field: __VIEWSTATE589.".

Any help appreciated,

Nick

===================================
This list is hosted by DevelopMentor(r) http://www.develop.com

View archives and manage your subscription(s) at http://discuss.develop.com

===================================
This list is hosted by DevelopMentor(r) http://www.develop.com

View archives and manage your subscription(s) at http://discuss.develop.com

===================================
This list is hosted by DevelopMentor® http://www.develop.com

View archives and manage your subscription(s) at http://discuss.develop.com