'Validation of viewstate MAC failed' problem, no load-balancing, cluster or server farm

This is a particularly unhelpful and difficult issue that we're experiencing with a number of sites. These are reasonably high-traffic and complex sites, but they're all on the one box - there's no load-balancing or web farm going on. It's very hard to reliably reproduce but any ideas a开发者_开发问答bout potential fixes would be appreciated.

Just to emphasise, the problem happens very intermittently (maybe 1 in a 100?) and at this stage I can't isolate any particular action on the site causing the problem.

The only genuine solution we can think of is converting the sites to MVC, but as you can imagine this is a really big task.

Sites are built in .NET3.5, are obviously web forms based, hosted on a box running Windows Server 2008 standard, 32-bit, IIS7, application pools runing in 'Classic' mode.

OK, I was able to reproduce this error by leaving the login form for a long time then filling in the form and hitting submit. After searching for 'viewstate expire' and reading around a bit more I've had a go at manually setting the element in my Web.config.

The specific element to add to your Web.config file is:

<system.web>
  <machineKey
    validationKey="EEF33150A048D162D22CB36E1CB9956B148C7A4E6999D0F05B53D416D7A16F83823DD626F501DD3549D3E5DCB473634739D0AD9A07F71560946498C943A7586D"
    decryptionKey="0E95F75864047EB6322EA7D5246F2C1175D77A1B016F293C3BAAD000299A3DC8"
    validation="SHA1"
    decryption="AES" />
</system.web>

The values in the validationKey and decryptionKey attributes are just randomly generated hex numbers, but need to be exactly 128 and 64 bytes respectively.