Is including the SessionID even necessary if you are using encrypted ViewState? How could a malicious user generate a valid encrypted ViewState?
A malicious user could generate a valid, encrypted ViewState by visiting the page in question themselves and extracting the value. If the Session ID is not part of the ViewState value then this value will be valid for all sessions.
This is also mentioned on the Microsoft page Securing View State:-
Per-user View State Encoding
If your Web site authenticates users, you can set the ViewStateUserKey
property in the Page_Init
event handler to associate the page's view state with a specific user. This helps prevent one-click attacks, in which a malicious user creates a valid, pre-filled Web page with view state from a previously created page. The attacker then lures a victim into clicking a link that sends the page to the server using the victim's identity.
When the ViewStateUserKey
property is set, the attacker's identity is used to create the hash of the view state of the original page. When the victim is lured into resending the page, the hash values will be different because the user keys are different. The page will fail verification and an exception will be thrown.
You must the ViewStateUserKey
property to a unique value for each user, such as the user name or identifier.