Summary
Acunetix 360 detected that ViewState Encryption is disabled.
Impact
An attacker can study the application's state management logic for possible vulnerabilities; if your application stores application-critical information in the ViewState, it will also be revealed.
Remediation
ASP.NET provides encryption for ViewState parameters.
For page based protection, place the following directive at the top of affected page.
For page based protection, place the following directive at the top of affected page.
<%@Page ViewStateEncryptionMode="Always" %>You can also set this option for the whole application by using
web.config files. Apply the following configuration for your application's web.config file.
<System.Web>
<pages viewStateEncryptionMode="Always">
</System.Web>