If you have an SSL certificate for a web site, is it necessary to make the ViewState more difficult to decode. Without any extra development, it appears that ASP.NET encodes it as a base 64 string. I found some sample code to easily decode this hidden field "__VIEWSTATE". Doesn't SSL encrypt this (along with other things) for you?
You have to distinguish two kinds of attackers:
SSL is used during transport to prevent a third person from reading and modifying the transmitted data.
The user who sends data to the server and gets answers from the server, can obviously see and modify the data any way he or she wants. So the user can modify the hidden form field containing the view state. Base64 escaping does not offer any protection here, it is just a way to ensure that binary data is not messed up by character set conversations.
So in the likely case that your view state contains trustworthy information, that a malicious user must not modify, you need to enable encryption and signing for it.
|show 2 more comments|
"Encrypt" is different than "encode". BASE64 is not an encryption algorithm.
ViewState contains "binary" information -- information that is more than simple text. Since you cannot (or should not) have binary information the HTML META tags or HTTP cookies, the binary data has be encoded in a text format. BASE64 encoding is a popular choice, so is simple hex encoding.
Note that the ViewState variable is also ASN.1 encoded. It contains numerous, variable length fields, which are "tagged" with type information and length encoded.
Inside all that, the ViewState variable contains cryptographically secure information, such as session IDs, that are resistant to tampering, so that hackers cannot manipulate one person's session IDs in order to hack into somebody else's session. That's why you see ViewState decoders out there: sometimes website operators don't use the right cryptographic primates, and expose the Viewstate internals to manipulation by hackers.
As other responses have said, SSL only encrypts the traffic on the network wire, so that people cannot eavesdrop on it. Obviously, it has to be decrypted on your side so that your browser an render the page, and on the server side when it creates the page.
ASP.NET 2.0 or later also sends a MAC key which acts as a hash and helps prevent tampering, see this page for details. That sets the barrier to attack a bit higher than just messing with a base64 encoded string.