ViewState is not Encrypted

Description

The ViewState is a hidden form input in ASP.NET pages which is used automatically to persist information such as non-default values of controls. It is also possible to store application data specific to a page in the ViewState. If the ViewState is not encrypted, anyone can see stored values in it.

Recommendation

Do not store sensitive values in the ViewState and enable encryption for it. To enable ViewState encryption for the whole application, add the below lines to the pages node under system.web of the Web.Config.

<system.web>
  <pages viewStateEncryptionMode="Always" />
</system.web>

To enable encryption for a specific page add the below line at the top of the page:

<%@Page ViewStateEncryptionMode="Always" %>

References

• CWE-200
• OWASP 2007-A6
• OWASP 2021-A1
• OWASP 2017-A6
• OWASP 2021-A5
• CWE-16