This post originated from an RSS feed registered with .NET Buzz by Scott Hanselman. Original Post: ViewStateUserKey makes ViewState more tamper-resistant Feed Title: Scott Hanselman's ComputerZen.com Feed URL: http://radio-weblogs.com/0106747/rss.xml Feed Description: Scott Hanselman's ComputerZen.com is a .NET/WebServices/XML Weblog. I offer details of obscurities (internals of ASP.NET, WebServices, XML, etc) and best practices from real world scenarios. Latest .NET Buzz Posts Latest .NET Buzz Posts by Scott Hanselman Latest Posts From Scott Hanselman's ComputerZen.com

Here's a little-known but very useful no-brainer to add to your ASP.NET application's base Page.

void Page_Init (Object sender, EventArgs e)
{
   if (User.Identity.IsAuthenticated)
      ViewStateUserKey = User.Identity.Name;
}

"What this does is key the view state to an individual using a unique value of your choice.  This option, which is only available in ASP.NET 1.1, is the Page.ViewStateUserKey. This needs to be applied in Page_Init because the key has to be provided to ASP.NET before view state is loaded."

For more good details on preventing tampering and best-practices with ASP.NET, visit Anil John's page on Authentication/Authorization and Defense in Depth.