The use of ViewState

when the Web Forms control is set to runat = "server", this control is appended with a hidden property _viewstate,_viewstate holds all the control's state values in ViewState. ViewState is a collection of name/value objects. When a page is requested, ASP. NET serializes the state of all controls into a string and then sends it to the client as a hidden property of the form, when the client bar page is returned, ASP. NET parses the returned form properties and assigns the corresponding values to the control.

When we are writing an ASP. NET form, once the form Runat=server is marked, ASP. NET will automatically add a hidden field to the page at output

<input type= "hidden" name= "__viewstate" value= "" ">

So, with this hidden field, the state of all the other controls on the page, including some state of the page itself, will be saved in the control's value. Each time the page commits to the background, ASP. NET decodes the values, and then outputs the values to restore the state of each control. Let's look at the value of this control again, it may resemble the following form: Oz4+o2w8atwxpjs+o2w8 .... Many people will think that this is encrypted information, in fact, not, MS is simply to the individual control and page state into the appropriate object inside, and then serialize the object, and then do a base64 encoding, directly assigned to the ViewState control.

First, the principle of ViewState

1. Browser Request Default.aspx page

2. The server-side discovery creates a VIEWSTATE this time will automatically create a name called __viewstate (Double down lines are all uppercase)
The hidden domain whose hidden field value is Base64 encrypted after it is returned to the browser side this encryption process in the page life cycle
The SaveState event in the Saveallstate method is completed

3. When the browser submits the form, the __viewstate hidden field is also submitted to the server at this time, the ReadState event of the page life cycle
The Readallstate method decrypts the encrypted value back to Base64 and finally assigns the value to the viewstate named name.

4. Finally, to manipulate the values in the ViewState

Second, the use of ViewState:

1. Defining ViewState Properties

public int pagecount{

Get{return (int) viewstate["PageCount"];}

set{viewstate["PageCount"]=value;}

}

2. Conditions for using ViewState

If you want to use ViewState, you must have a server-side form tag in the ASPX page (<form runat = "server" >). A form field is required so that a hidden field containing viewstate information can be passed back to the server. Also, the form must be a server-side form, so that the ASP. NET page framework can add hidden fields when the page is executed on the server.

The EnableViewState property value of page is True

The EnableViewState property value of the control is true

3.ViewState places to be aware of

A. When there is a page callback, you do not need to maintain the value of the control to disable ViewState.
B. The index of the ViewState is case-sensitive.
C. ViewState is not a cross-page.

D. In order to be able to be saved in ViewState, the object must be either fluidization or TypeConverter defined.
E. When the TextMode property of a TextBox control is set to password, its state will not be saved in ViewState, which should be for security reasons.
F. Do not use ViewState when the page does not return or redirect or when it is transferred to another page (transfer).

G. Be careful about the ViewState of a control when it is dynamically built.
H. When the ViewState of a program is forbidden, the ViewState of all pages of the program is also banned.
I. ViewState is only persistent when the page is returned to itself.

4. Set ViewState

ViewState can be set in controls, pages, programs, and global configurations. By default, EnableViewState is true. If you want to disable all page ViewState functionality, you can set EnableViewState to False in the program configuration.

Iii. the __viewstate produced

Use ViewStateDecoder2 (ViewState Viewer) to see the value

So viewstate on the security is still relatively poor, it is recommended not to store more confidential and sensitive information, although viewstate can be encrypted, but because viewstate to save on the client, there is inherent security risks.

Iv. comparison of ViewState and session

(1) The session value is stored in the server memory, then, it is certain that a large number of use of the session will result in heavier server burden. Instead of ViewState server resources by simply depositing data into a page-hidden control, we can save variables and objects that require the server to "remember" into viewstate. Sesson should only be applied to variables and object stores that require cross-pages and are related to each access user.

(2) The session expires in 20 minutes by default, and ViewState never expires.

But ViewState is not able to store all of the. NET type data, it only supports string, Integer, Boolean, Array, ArrayList, Hashtable, and some types of customizations.

Everything has two sides, using ViewState will increase the output of the page HTML, the use of more bandwidth, which we need to consider carefully. In addition, since all viewstate are stored in a hidden domain, the user can easily view the source code to see this base64 encoded value. Then you can get the object and the variable value that you stored in the conversion.

The use of ViewState