Recently while working on a DotnetNuke portal, I got a report from a test user that while logging in to the application, he ran into following exception message.
DotNetNuke.Services.Exceptions.PageLoadException: Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that
While researching this issue I ran into lot of blogs and postings about lot of this being related to certain type of controls and some talked about rendering problem when page is too large. In my case this does not seem to the the problem because it was a simple login screen with 2 text boxes and few buttons. I looked at the source of the page and all hidden variables related to view state and post back seem to be rendered completely.
After digging little bit more into it, I found that this had to with view state really being invalid in this case. What happened is that the user was sitting on the page and went away for few hours. And try to login or logout from portal by using appropriate link or button. When post back happened, the session was already gone but there was FORM data present from previous session when post back happened. This is security mechanism of ASP.Net that it verifies if VIEWSTATE is valid or not. Since the session had already expired, there was no way that the framework was going to decrypt old viewstate because session keys have changed now.
There is a good explanation on this topic and some debugging tips at Validation of viewstate MAC failed error. It is definitely worth reading.