如何查看viewstate

鼠标右键页面,然后view page source

源码中搜索viewstate,会找到一个隐藏的字段。

<input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" value="/wEPaA8FDzhkNmJlYWE3ODdlY2ZhMxgFBRpjdGwwMCRjcGhNYWluJHVjUHJvZmlsZSRJZA8FATVkBSBjdGwwMCRjcGhNYWluJHVjUHJvZmlsZSRMYXN0TmFtZQ8FA+WNomQFG2N0bDAwJGNwaE1haW4kdWNQcm9maWxlJEFnZQ8FAjMyZAUhY3RsMDAkY3BoTWFpbiR1Y1Byb2ZpbGUkRmlyc3ROYW1lDwUG5L+K5rabZAUdY3RsMDAkY3BoTWFpbiR1Y1Byb2ZpbGUkTW9uZXkPBQwwLjAwMDAwMjU1MjBkq9Xg7eCkuRMKxXAWft9MqgH5A1AKB7Ai3JQcgVlh+OI=" />

还有可能搜到一个叫__VIEWSTATEGENERATOR的字段,不过这个不是viewstate

<input type="hidden" name="__VIEWSTATEGENERATOR" id="__VIEWSTATEGENERATOR" value="8EB90039" />

F12,然后在elements菜单中进行搜索

解密

通过这个页面,可以进行解密http://viewstatedecoder.azurewebsites.net/

需要注意是有可能只能部分解密

32 byte(s) left over, perhaps an HMACSHA256 signature?

浅谈ViewState

一、ViewState概述
① ViewState是基于webform的

② 在web窗体控件属性处设置runat = "server",这个控件会被附加一个隐藏的属性_ViewState,_ViewState存放了所有控件在ViewState中的状态值。

③ 页面会在输出时,自动添加下面的隐藏域:

value处的值只是base64编码并不是加密。

④ ViewState是一个名称/值的对象集合。

⑤ 当请求某个页面时,ASP.NET会把所有控件的状态序列化成一个字符串,然后作为窗体的隐藏属性送到客户端,当客户端将页面回传时,ASP.NET分析回传的窗体属性,并赋给控件对应的值。(恢复现场)

⑥ ViewState不能存储所有的数据类型,仅支持:String、Integer、Boolean、Array、ArrayList、Hashtable

防止篡改

How to Make ViewState Secure in ASP.NET

Understanding ASP.NET View State

ASP.NET View State Overview

What Is View State And How It Works In ASP.NET

Background 

A web application is stateless.
That means that a new instance of a page is created every time when we make a request to the server to get the page and after the round trip our page has been lost immediately.
It only happens because of one server, all the controls of the Web Page is created and after the round trip the server destroys all the instances. So to retain the values of the controls we use state management techniques.
 

State Management Techniques

 
They are classified into the following 2 categories,
 

 
Now I am explaining what View State is.
 

View State

 
View State is the method to preserve the Value of the Page and Controls between round trips. It is a Page-Level State Management technique. View State is turned on by default and normally serializes the data in every control on the page regardless of whether it is actually used during a post-back.
 
Now I am showing you an example of what the problem is when we don't use view state.
    //Declaration of a and b
public string a, b;
protected void Button1_Click(object sender, EventArgs e)
{
//TextBox1 and TextBox2 Value is Assigning on the variable a and b
a = TextBox1.Text;
b = TextBox2.Text;
//after clicking on Button TextBox value Will be Cleared
TextBox1.Text = TextBox2.Text = string.Empty;
} protected void Button3_Click(object sender, EventArgs e)
{
//value of variable a and b is assingning on TextBox1 and Textbox2
TextBox1.Text = a;
TextBox2.Text = b;
}
 
It only happens because all the controls are classes and on the server all the Control Objects are created and then after the round trip the Page is returned to the client's browser in HTML format and the objects are destroyed at the server.
 
After the Submit button is clicked the value of user name and password is submitted to the server.
We cannot restore the value again because after the postback the instance of the control is destroyed and on clicking of the Restore Button the server takes a new request and the server cannot restore the value of the TextBox.
 

Features Of View State

 
These are the main features of view state,
  1. Retains the value of the Control after post-back without using a session.
  2. Stores the value of Pages and Control Properties defined in the page.
  3. Creates a custom View State Provider that lets you store View State Information in a SQL Server Database or in another data store.
And now I am explaining the stored value in the View State and the remaining steps are the same as the previous.
    protected void Button1_Click(object sender, EventArgs e)
{
//Value of Textbox1 and TectBox2 is assigin on the ViewState
ViewState["name"] = TextBox1.Text;
ViewState["password"] = TextBox2.Text;
//after clicking on Button TextBox value Will be Cleared
TextBox1.Text = TextBox2.Text = string.Empty;
}
protected void Button3_Click(object sender, EventArgs e)
{
//If ViewState Value is not Null then Value of View State is Assign to TextBox
if (ViewState["name"] != null)
{
TextBox1.Text = ViewState["name"].ToString();
}
if (ViewState["password"] != null)
{
TextBox2.Text = ViewState["password"].ToString();
}
}
After clicking on the Submit Button the value of user name and password is submitted in View State and the View State stores the value of user name and password during post-back.
 
After click on the Restore Button we can get the value again. The Value must be retained during post-back and the values are stored into a base 64 encoded string and this information is then put into the View State Hidden Field.

Data Objects That Can be Stored in View state

  1. String
  2. Boolean Value
  3. Array Object
  4. Array List Object
  5. Hash Table
  6. Custom type Converters

Advantages of View State

  1. Easy to Implement.
  2. No server resources are required: The View State is contained in a structure within the page load.
  3. Enhanced security features: It can be encoded and compressed or Unicode implementation.

Disadvantages of View State

  1. Security Risk: The Information of View State can be seen in the page output source directly. You can manually encrypt and decrypt the contents of a Hidden Field, but It requires extra coding. If security is a concern then consider using a Server-Based state Mechanism so that no sensitive information is sent to the client.
  2. Performance: Performance is not good if we use a large amount of data because View State is stored in the page itself and storing a large value can cause the page to be slow.
  3. Device limitation: Mobile Devices might not have the memory capacity to store a large amount of View State data.
  4. It can store values for the same page only.

When We Should Use View State

  1. When the data to be stored is small.
  2. Try to avoid secure data.

View State的更多相关文章

  1. No saved view state could be found for the view identifier

    解决方法: javax.faces.application.ViewExpiredException:No saved view state could be found for the view i ...

  2. ASP值view State

    using System; using System.Collections.Generic; using System.Linq; using System.Web; using System.We ...

  3. View的onSaveInstanceState和onRestoreInstanceState过程分析

    为什么要介绍这2个方法呢?这是因为在我们的开发中最近遇到了一个很诡异的bug.大体是这样的:在我们的ViewPager中 有2页的root view都是ScrollView,我们在xml里面都用了an ...

  4. SPRING IN ACTION 第4版笔记-第八章Advanced Spring MVC-002-SpringFlow的组件(state\<transition>\<var>\<set>\<evaluate>)

    一. In Spring Web Flow, a flow is defined by three primary elements: states, transitions,and flow dat ...

  5. [AngularJS] Default Child state and nav between child state

    Let's say we want a parent state which is a abstract state. Two children states, one is for sinlge a ...

  6. go语言使用go-sciter创建桌面应用(七) view对象常用方法,文件选择,窗口弹出,请求

    view对象的详细文档请看: https://sciter.com/docs/content/sciter/View.htm demo9.html代码如下: <!DOCTYPE html> ...

  7. what is diff. b/w app state & session state

    Application state is a data repository available to all classes in an ASP.NET application. Applicati ...

  8. java.lang.IllegalArgumentException: Wrong state classs

    java.lang.IllegalArgumentException: Wrong state class, expecting View State but received class cn.et ...

  9. Change Field Layout and Visibility in a List View 在列表视图中更改字段布局和可见性

    This lesson will guide you through the steps needed to select columns displayed in the List View. Fo ...

随机推荐

  1. PGA和UGA内存的使用情况

    引用thomas kyte的PGA和UGA的统计内存的使用情况,用排序区不同的大小来查看pga.UGA.物理读取不同内存使用 会话1:创建测试表和测试不同排序大小 create table t as ...

  2. Android实现App版本自动更新

    现在很多的App中都会有一个检查版本的功能.例如斗鱼TV App的设置界面下: 当我们点击检查更新的时候,就会向服务器发起版本检测的请求.一般的处理方式是:服务器返回的App版本与当前手机安装的版本号 ...

  3. Saying Good-bye to Cambridge Again

    Saying Good-bye to Cambridge Again Very quietly I take my leave,      As quietly as I came here;     ...

  4. 机器学习(七) PCA与梯度上升法 (下)

    五.高维数据映射为低维数据 换一个坐标轴.在新的坐标轴里面表示原来高维的数据. 低维 反向 映射为高维数据 PCA.py import numpy as np class PCA: def __ini ...

  5. PostgreSQL Replication之第五章 设置同步复制(2)

    5.2 理解实际影响和性能 在本章中,我们已经讨论了实际影响以及性能影响.但是,有什么好的理论性的例子吗?让我们做一个简单的基准测试,看看复制是怎么做的.我们做这样的测试来为您显示各种耐久性的级别不只 ...

  6. Vue.js小demo

    <!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8&quo ...

  7. 操作系统——第五章 输入输出(I/O)管理

    这就是SDT表和DCT表

  8. js字符串排序方法

    前端开发过程中有时需自己手写排序方法 一般想到数字的字符串排序方法 我们会用到 var newArr = arr. sort(function(a,b){return a - b})来进行排序 但除此 ...

  9. iOS 实现QQ界面

    应师傅要求编写个QQ界面来不吝赐教下我的代码问题. 编写个QQ界面.有三个组,每一个组有人.并显示在线不在线. 先看一下效果图 这里省了事由于我的图片仅仅用了一张.假设要依据人的不同设置,仅仅要在ce ...

  10. 面对即将终止支持的server你还能做些什么

    watermark/2/text/aHR0cDovL2Jsb2cuY3Nkbi5uZXQvaXF1c2hp/font/5a6L5L2T/fontsize/400/fill/I0JBQkFCMA==/d ...