View State
如何查看viewstate
鼠标右键页面,然后view page source
源码中搜索viewstate,会找到一个隐藏的字段。
<input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" value="/wEPaA8FDzhkNmJlYWE3ODdlY2ZhMxgFBRpjdGwwMCRjcGhNYWluJHVjUHJvZmlsZSRJZA8FATVkBSBjdGwwMCRjcGhNYWluJHVjUHJvZmlsZSRMYXN0TmFtZQ8FA+WNomQFG2N0bDAwJGNwaE1haW4kdWNQcm9maWxlJEFnZQ8FAjMyZAUhY3RsMDAkY3BoTWFpbiR1Y1Byb2ZpbGUkRmlyc3ROYW1lDwUG5L+K5rabZAUdY3RsMDAkY3BoTWFpbiR1Y1Byb2ZpbGUkTW9uZXkPBQwwLjAwMDAwMjU1MjBkq9Xg7eCkuRMKxXAWft9MqgH5A1AKB7Ai3JQcgVlh+OI=" />
还有可能搜到一个叫__VIEWSTATEGENERATOR的字段,不过这个不是viewstate
<input type="hidden" name="__VIEWSTATEGENERATOR" id="__VIEWSTATEGENERATOR" value="8EB90039" />
F12,然后在elements菜单中进行搜索
解密
通过这个页面,可以进行解密http://viewstatedecoder.azurewebsites.net/
需要注意是有可能只能部分解密
32 byte(s) left over, perhaps an HMACSHA256 signature?
浅谈ViewState
一、ViewState概述
① ViewState是基于webform的
② 在web窗体控件属性处设置runat = "server",这个控件会被附加一个隐藏的属性_ViewState,_ViewState存放了所有控件在ViewState中的状态值。
③ 页面会在输出时,自动添加下面的隐藏域:
value处的值只是base64编码并不是加密。
④ ViewState是一个名称/值的对象集合。
⑤ 当请求某个页面时,ASP.NET会把所有控件的状态序列化成一个字符串,然后作为窗体的隐藏属性送到客户端,当客户端将页面回传时,ASP.NET分析回传的窗体属性,并赋给控件对应的值。(恢复现场)
⑥ ViewState不能存储所有的数据类型,仅支持:String、Integer、Boolean、Array、ArrayList、Hashtable
防止篡改
How to Make ViewState Secure in ASP.NET
Understanding ASP.NET View State
What Is View State And How It Works In ASP.NET
Background
State Management Techniques
View State
//Declaration of a and b
public string a, b;
protected void Button1_Click(object sender, EventArgs e)
{
//TextBox1 and TextBox2 Value is Assigning on the variable a and b
a = TextBox1.Text;
b = TextBox2.Text;
//after clicking on Button TextBox value Will be Cleared
TextBox1.Text = TextBox2.Text = string.Empty;
} protected void Button3_Click(object sender, EventArgs e)
{
//value of variable a and b is assingning on TextBox1 and Textbox2
TextBox1.Text = a;
TextBox2.Text = b;
}
Features Of View State
- Retains the value of the Control after post-back without using a session.
- Stores the value of Pages and Control Properties defined in the page.
- Creates a custom View State Provider that lets you store View State Information in a SQL Server Database or in another data store.
protected void Button1_Click(object sender, EventArgs e)
{
//Value of Textbox1 and TectBox2 is assigin on the ViewState
ViewState["name"] = TextBox1.Text;
ViewState["password"] = TextBox2.Text;
//after clicking on Button TextBox value Will be Cleared
TextBox1.Text = TextBox2.Text = string.Empty;
}
protected void Button3_Click(object sender, EventArgs e)
{
//If ViewState Value is not Null then Value of View State is Assign to TextBox
if (ViewState["name"] != null)
{
TextBox1.Text = ViewState["name"].ToString();
}
if (ViewState["password"] != null)
{
TextBox2.Text = ViewState["password"].ToString();
}
}
Data Objects That Can be Stored in View state
- String
- Boolean Value
- Array Object
- Array List Object
- Hash Table
- Custom type Converters
Advantages of View State
- Easy to Implement.
- No server resources are required: The View State is contained in a structure within the page load.
- Enhanced security features: It can be encoded and compressed or Unicode implementation.
Disadvantages of View State
- Security Risk: The Information of View State can be seen in the page output source directly. You can manually encrypt and decrypt the contents of a Hidden Field, but It requires extra coding. If security is a concern then consider using a Server-Based state Mechanism so that no sensitive information is sent to the client.
- Performance: Performance is not good if we use a large amount of data because View State is stored in the page itself and storing a large value can cause the page to be slow.
- Device limitation: Mobile Devices might not have the memory capacity to store a large amount of View State data.
- It can store values for the same page only.
When We Should Use View State
- When the data to be stored is small.
- Try to avoid secure data.
View State的更多相关文章
- No saved view state could be found for the view identifier
解决方法: javax.faces.application.ViewExpiredException:No saved view state could be found for the view i ...
- ASP值view State
using System; using System.Collections.Generic; using System.Linq; using System.Web; using System.We ...
- View的onSaveInstanceState和onRestoreInstanceState过程分析
为什么要介绍这2个方法呢?这是因为在我们的开发中最近遇到了一个很诡异的bug.大体是这样的:在我们的ViewPager中 有2页的root view都是ScrollView,我们在xml里面都用了an ...
- SPRING IN ACTION 第4版笔记-第八章Advanced Spring MVC-002-SpringFlow的组件(state\<transition>\<var>\<set>\<evaluate>)
一. In Spring Web Flow, a flow is defined by three primary elements: states, transitions,and flow dat ...
- [AngularJS] Default Child state and nav between child state
Let's say we want a parent state which is a abstract state. Two children states, one is for sinlge a ...
- go语言使用go-sciter创建桌面应用(七) view对象常用方法,文件选择,窗口弹出,请求
view对象的详细文档请看: https://sciter.com/docs/content/sciter/View.htm demo9.html代码如下: <!DOCTYPE html> ...
- what is diff. b/w app state & session state
Application state is a data repository available to all classes in an ASP.NET application. Applicati ...
- java.lang.IllegalArgumentException: Wrong state classs
java.lang.IllegalArgumentException: Wrong state class, expecting View State but received class cn.et ...
- Change Field Layout and Visibility in a List View 在列表视图中更改字段布局和可见性
This lesson will guide you through the steps needed to select columns displayed in the List View. Fo ...
随机推荐
- PGA和UGA内存的使用情况
引用thomas kyte的PGA和UGA的统计内存的使用情况,用排序区不同的大小来查看pga.UGA.物理读取不同内存使用 会话1:创建测试表和测试不同排序大小 create table t as ...
- Android实现App版本自动更新
现在很多的App中都会有一个检查版本的功能.例如斗鱼TV App的设置界面下: 当我们点击检查更新的时候,就会向服务器发起版本检测的请求.一般的处理方式是:服务器返回的App版本与当前手机安装的版本号 ...
- Saying Good-bye to Cambridge Again
Saying Good-bye to Cambridge Again Very quietly I take my leave, As quietly as I came here; ...
- 机器学习(七) PCA与梯度上升法 (下)
五.高维数据映射为低维数据 换一个坐标轴.在新的坐标轴里面表示原来高维的数据. 低维 反向 映射为高维数据 PCA.py import numpy as np class PCA: def __ini ...
- PostgreSQL Replication之第五章 设置同步复制(2)
5.2 理解实际影响和性能 在本章中,我们已经讨论了实际影响以及性能影响.但是,有什么好的理论性的例子吗?让我们做一个简单的基准测试,看看复制是怎么做的.我们做这样的测试来为您显示各种耐久性的级别不只 ...
- Vue.js小demo
<!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8&quo ...
- 操作系统——第五章 输入输出(I/O)管理
这就是SDT表和DCT表
- js字符串排序方法
前端开发过程中有时需自己手写排序方法 一般想到数字的字符串排序方法 我们会用到 var newArr = arr. sort(function(a,b){return a - b})来进行排序 但除此 ...
- iOS 实现QQ界面
应师傅要求编写个QQ界面来不吝赐教下我的代码问题. 编写个QQ界面.有三个组,每一个组有人.并显示在线不在线. 先看一下效果图 这里省了事由于我的图片仅仅用了一张.假设要依据人的不同设置,仅仅要在ce ...
- 面对即将终止支持的server你还能做些什么
watermark/2/text/aHR0cDovL2Jsb2cuY3Nkbi5uZXQvaXF1c2hp/font/5a6L5L2T/fontsize/400/fill/I0JBQkFCMA==/d ...