ViewState is not Encrypted

Invicti detected that ViewState Encryption is disabled.

An attacker can study the application's state management logic for possible vulnerabilities; if your application stores application-critical information in the ViewState, it will also be revealed.

ASP.NET provides encryption for ViewState parameters.

For page based protection, place the following directive at the top of affected page.

<%@Page ViewStateEncryptionMode="Always" %>

You can also set this option for the whole application by using web.config files. Apply the following configuration for your application's web.config file.

<System.Web> <pages viewStateEncryptionMode="Always"></System.Web>