Is EnableViewStateMAC=true compulsory for ViewStateEncryption in an ASP.Net Website?

Question

I'm currently fixing some Security issues in our ASP.net website application.

One of the issue was that the ViewState was not encrypted.

So I did check on StackOverFlow and elsewhere on how to encrypt the viewState, and I did it using the <pages viewStateEncryptionMode="Always" /> and adding a 3DES machinekey like this <machineKey validation="3DES" /> in Web.config .

I would like to know if the "EnableViewStateMAC=true" is also compulsorily necessary? since this was mentioned in some of the suggested solutions I had found online. But, on my checks I found the encryption is working even without this.

[NOTE: I had to do these changes at an application level (Web.config) since making individual page changes is not a practical solution for this application.]

Answer 1

Do not ever set EnableViewStateMac to false, even if encryption is enabled. The MAC guarantees that the client cannot maliciously tamper with the contents of ViewState. (Encryption by itself isn't sufficient to guarantee this; the MAC is necessary.)

The EnableViewStateMac property will be removed in a future version of the product since there is no valid reason to set it to 'false'.

Answer 2

Just in case:

Starting with ASP.NET 4.5.2, the runtime enforces EnableViewStateMac = true

more details here: ASP.NET 4.5.2 and EnableViewStateMac