Tuesday, February 12, 2008

Fooling the Ektron CMS400 login.aspx page

This probably will not be of any use outside of our environment but, I'll post it for my own sanity.

When confronted with this error when using a coldfusion form to submit the login.aspx on the Ektron CMS400.net

Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that machineKey configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.

The first thing to take a look at is the values to the hidden form elements that .net is kind enough to insert for state info and validation. These if these values are hard coded into your cheating login page then you will get the above error. (I would bet that this same issue will pop up anytime someone tries to submit a .net form)

Check __EVENTVALIDATION & __VIEWSTATE field values.

No comments: