ASP.NET viewstate encryption disabled

Description

This web application is configured with the pages property viewStateEncryptionMode set to Never. When configured this way, the viewstate encryption is disabled and it's possible to see the base64-encoded data stored in the viewstate. If sensitive data is stored in the state it's recommended to enable viewstate encryption.

Remediation

It's recommended to enable viewstate encryption by setting the <strong>page</strong> property <strong>viewStateEncryptionMode</strong> to <strong>Auto</strong> or <strong>Always</strong>. <pre> &lt;pages viewStateEncryptionMode=&quot;Auto&quot;&gt; </pre>

References

Related Vulnerabilities