Download Netsparker
Pricing
Blog
Contact
Netsparker

ViewState Data of Web Application is Not Encrypted

Netsparker detected that ViewState encryption is disabled.

Impact

An attacker can study the application's state management logic for possible vulnerabilities; if your application stores application-critical information in the ViewState, it will also be revealed.

Remedy

ASP.NET provides encryption for ViewState parameters.

For page based protection, place the following directive at the top of affected page.
<%@Page ViewStateEncryptionMode="Always" %>
You can also set this option for the whole application by using web.config files. Apply the following configuration for your application's web.config file.
<System.Web>
    <pages viewStateEncryptionMode="Always"> 
</System.Web>      

Remedy References


Go back to the Complete list of Vulnerability Checks.