如何查看viewstate

鼠标右键页面,然后view page source

源码中搜索viewstate,会找到一个隐藏的字段。

<input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" value="/wEPaA8FDzhkNmJlYWE3ODdlY2ZhMxgFBRpjdGwwMCRjcGhNYWluJHVjUHJvZmlsZSRJZA8FATVkBSBjdGwwMCRjcGhNYWluJHVjUHJvZmlsZSRMYXN0TmFtZQ8FA+WNomQFG2N0bDAwJGNwaE1haW4kdWNQcm9maWxlJEFnZQ8FAjMyZAUhY3RsMDAkY3BoTWFpbiR1Y1Byb2ZpbGUkRmlyc3ROYW1lDwUG5L+K5rabZAUdY3RsMDAkY3BoTWFpbiR1Y1Byb2ZpbGUkTW9uZXkPBQwwLjAwMDAwMjU1MjBkq9Xg7eCkuRMKxXAWft9MqgH5A1AKB7Ai3JQcgVlh+OI=" />

还有可能搜到一个叫__VIEWSTATEGENERATOR的字段,不过这个不是viewstate

<input type="hidden" name="__VIEWSTATEGENERATOR" id="__VIEWSTATEGENERATOR" value="8EB90039" />

F12,然后在elements菜单中进行搜索

解密

通过这个页面,可以进行解密http://viewstatedecoder.azurewebsites.net/

需要注意是有可能只能部分解密

32 byte(s) left over, perhaps an HMACSHA256 signature?

浅谈ViewState

一、ViewState概述
① ViewState是基于webform的

② 在web窗体控件属性处设置runat = "server",这个控件会被附加一个隐藏的属性_ViewState,_ViewState存放了所有控件在ViewState中的状态值。

③ 页面会在输出时,自动添加下面的隐藏域:

value处的值只是base64编码并不是加密。

④ ViewState是一个名称/值的对象集合。

⑤ 当请求某个页面时,ASP.NET会把所有控件的状态序列化成一个字符串,然后作为窗体的隐藏属性送到客户端,当客户端将页面回传时,ASP.NET分析回传的窗体属性,并赋给控件对应的值。(恢复现场)

⑥ ViewState不能存储所有的数据类型,仅支持:String、Integer、Boolean、Array、ArrayList、Hashtable

防止篡改

How to Make ViewState Secure in ASP.NET

Understanding ASP.NET View State

ASP.NET View State Overview

What Is View State And How It Works In ASP.NET

Background 

A web application is stateless.
That means that a new instance of a page is created every time when we make a request to the server to get the page and after the round trip our page has been lost immediately.
It only happens because of one server, all the controls of the Web Page is created and after the round trip the server destroys all the instances. So to retain the values of the controls we use state management techniques.
 

State Management Techniques

 
They are classified into the following 2 categories,
 

 
Now I am explaining what View State is.
 

View State

 
View State is the method to preserve the Value of the Page and Controls between round trips. It is a Page-Level State Management technique. View State is turned on by default and normally serializes the data in every control on the page regardless of whether it is actually used during a post-back.
 
Now I am showing you an example of what the problem is when we don't use view state.
    //Declaration of a and b
public string a, b;
protected void Button1_Click(object sender, EventArgs e)
{
//TextBox1 and TextBox2 Value is Assigning on the variable a and b
a = TextBox1.Text;
b = TextBox2.Text;
//after clicking on Button TextBox value Will be Cleared
TextBox1.Text = TextBox2.Text = string.Empty;
} protected void Button3_Click(object sender, EventArgs e)
{
//value of variable a and b is assingning on TextBox1 and Textbox2
TextBox1.Text = a;
TextBox2.Text = b;
}
 
It only happens because all the controls are classes and on the server all the Control Objects are created and then after the round trip the Page is returned to the client's browser in HTML format and the objects are destroyed at the server.
 
After the Submit button is clicked the value of user name and password is submitted to the server.
We cannot restore the value again because after the postback the instance of the control is destroyed and on clicking of the Restore Button the server takes a new request and the server cannot restore the value of the TextBox.
 

Features Of View State

 
These are the main features of view state,
  1. Retains the value of the Control after post-back without using a session.
  2. Stores the value of Pages and Control Properties defined in the page.
  3. Creates a custom View State Provider that lets you store View State Information in a SQL Server Database or in another data store.
And now I am explaining the stored value in the View State and the remaining steps are the same as the previous.
    protected void Button1_Click(object sender, EventArgs e)
{
//Value of Textbox1 and TectBox2 is assigin on the ViewState
ViewState["name"] = TextBox1.Text;
ViewState["password"] = TextBox2.Text;
//after clicking on Button TextBox value Will be Cleared
TextBox1.Text = TextBox2.Text = string.Empty;
}
protected void Button3_Click(object sender, EventArgs e)
{
//If ViewState Value is not Null then Value of View State is Assign to TextBox
if (ViewState["name"] != null)
{
TextBox1.Text = ViewState["name"].ToString();
}
if (ViewState["password"] != null)
{
TextBox2.Text = ViewState["password"].ToString();
}
}
After clicking on the Submit Button the value of user name and password is submitted in View State and the View State stores the value of user name and password during post-back.
 
After click on the Restore Button we can get the value again. The Value must be retained during post-back and the values are stored into a base 64 encoded string and this information is then put into the View State Hidden Field.

Data Objects That Can be Stored in View state

  1. String
  2. Boolean Value
  3. Array Object
  4. Array List Object
  5. Hash Table
  6. Custom type Converters

Advantages of View State

  1. Easy to Implement.
  2. No server resources are required: The View State is contained in a structure within the page load.
  3. Enhanced security features: It can be encoded and compressed or Unicode implementation.

Disadvantages of View State

  1. Security Risk: The Information of View State can be seen in the page output source directly. You can manually encrypt and decrypt the contents of a Hidden Field, but It requires extra coding. If security is a concern then consider using a Server-Based state Mechanism so that no sensitive information is sent to the client.
  2. Performance: Performance is not good if we use a large amount of data because View State is stored in the page itself and storing a large value can cause the page to be slow.
  3. Device limitation: Mobile Devices might not have the memory capacity to store a large amount of View State data.
  4. It can store values for the same page only.

When We Should Use View State

  1. When the data to be stored is small.
  2. Try to avoid secure data.

View State的更多相关文章

  1. No saved view state could be found for the view identifier

    解决方法: javax.faces.application.ViewExpiredException:No saved view state could be found for the view i ...

  2. ASP值view State

    using System; using System.Collections.Generic; using System.Linq; using System.Web; using System.We ...

  3. View的onSaveInstanceState和onRestoreInstanceState过程分析

    为什么要介绍这2个方法呢?这是因为在我们的开发中最近遇到了一个很诡异的bug.大体是这样的:在我们的ViewPager中 有2页的root view都是ScrollView,我们在xml里面都用了an ...

  4. SPRING IN ACTION 第4版笔记-第八章Advanced Spring MVC-002-SpringFlow的组件(state\<transition>\<var>\<set>\<evaluate>)

    一. In Spring Web Flow, a flow is defined by three primary elements: states, transitions,and flow dat ...

  5. [AngularJS] Default Child state and nav between child state

    Let's say we want a parent state which is a abstract state. Two children states, one is for sinlge a ...

  6. go语言使用go-sciter创建桌面应用(七) view对象常用方法,文件选择,窗口弹出,请求

    view对象的详细文档请看: https://sciter.com/docs/content/sciter/View.htm demo9.html代码如下: <!DOCTYPE html> ...

  7. what is diff. b/w app state & session state

    Application state is a data repository available to all classes in an ASP.NET application. Applicati ...

  8. java.lang.IllegalArgumentException: Wrong state classs

    java.lang.IllegalArgumentException: Wrong state class, expecting View State but received class cn.et ...

  9. Change Field Layout and Visibility in a List View 在列表视图中更改字段布局和可见性

    This lesson will guide you through the steps needed to select columns displayed in the List View. Fo ...

随机推荐

  1. Spring Boot: Tuning your Undertow application for throughput--转

    原文地址:https://jmnarloch.wordpress.com/2016/04/26/spring-boot-tuning-your-undertow-application-for-thr ...

  2. 关键字super

    1.super,相较于关键字this,可以修饰属性.方法.构造器 2.super修饰属性.方法:在子类的方法.构造器中,通过super.属性或者super.方法的形式,显式的调用父类的指定 属性或方法 ...

  3. java9新特性-18-统一的JVM日志系统

    1.官方Feature 158: Unified JVM Logging 271: Unified GC Logging 2.使用说明 日志是解决问题的唯一有效途径:曾经很难知道导致JVM性能问题和导 ...

  4. 关于docker部署javaweb应用的问题

    我做了两个镜像,一个mysql,一个tomcat.建完mysql容器之后,在建tomcat的时候用--link把他们链接起来了进tomcat的容器里面 /etc/hosts 也发现了mysql的ip但 ...

  5. 高德地图和canvas画图结合应用(一)

    现在重构web项目的时候发现,以前项目中是高德画基站的扇区的时候,通过计算点来画多边形,在站点的数量比较多的时候,会增加请求,同时计算扇区的时候有大量的计算,这样会极度浪费服务器的性能,所以对这块进行 ...

  6. PostgreSQL Replication之第九章 与pgpool一起工作(4)

    9.4 设置复制和负载均衡 要配置pgpool,我们可以简单地使用一个包含一种典型的配置信息的已经存在的样本文件,将它拷贝到我们的配置目录并修改之: $ cp /usr/local/etc/pgpoo ...

  7. PostgreSQL Replication之第四章 设置异步复制(5)

    4.5 使流复制更健壮 当连接到master时,slave要做的第一件事情是赶上master.但是,这会一直工作吗?我们已经看到,我们可以使用由基于流和基于文件组成的混合设置.这给了我们一些额外的安全 ...

  8. Generic type test java

    package test; public class GenericTest { public class Room<T> { private T t; public void add(T ...

  9. Kinect 人机交互开发实践

    Kinect for Windows SDK 骨骼追踪 —— 对在Kinect视野范围内移动的一个或两个人进行骨骼追踪,可追踪到人体的20个节点 深度摄像头 —— 通过深度传感器获取到视野内的环境三维 ...

  10. [BJOI2014]大融合 LCT维护子树信息

    Code: #include <cstdio> #include <algorithm> #include <cstring> #include <strin ...