Friday, December 9, 2011

Disabling ViewState not working in ASP.net


I have conducted many interviews, talked to the seasoned and experience .net developers and guess what 99% of them were confident enough to tell me that if you disable the view state of a asp.net control your data for that control won't be post back to server. If you are one of that 99%, you need to read that it is not true 'completely'.
ASP.net is build on the top of HTTP so it inherits some of the property of HTTP protocol. One of that property is HTTP is stateless so is ASP.net states are maintained in different ways in ASP.net. One of them is view state.
Before I prove my point, I want you to do this.
  1. Create a brand new ASP.NET Web Site project.
  2. In Default.aspx, drop one asp.net text box & one asp.net button control on this page. 
  3. Disable the view state of whole page by placing EnableViewState="false" in the page directives.
  4. Disable the view state of Form by enableviewstate="false" property.
  5. Disable the view state of text box by enableviewstate="false" property.
  6. Go to Page_Load function of Default.aspx and write the following code.

    protected void Page_Load(object sender, EventArgs e)
        {       
    if (IsPostBack)
            {
    
    



       System.Web.HttpContext.Current.Response.Write(@"<script javascript""="" language=""> alert('" + TextBox1.Text + "') </script>");

    
    
    

        }

  7.  Run the application and type something in the text box and press enter or click the button to post it back to the server.I am confident enough that your data will be displayed in alert box though you have disabled the viewstate of whole page, form and textbox control.
I understand that you must be thinking this is bug or something but it is not. I will explain it in the bottom section but for right now I want you to drop a asp.net label control and disable its view state by enableviewstate="false.
Now add the following lines in your Page_Load event and re run the applicaiton.



if (IsPostBack)
        {  
System.Web.HttpContext.Current.Response.Write(@"<SCRIPT LANGUAGE=""JavaScript"">alert('" + Label1.Text + "')</SCRIPT>");
            Label1.Text = "My label";
        }

Click on Button to post back the page. You will see an alert box with the lable's text property as "Label". In the above code, we have actually changed the label's text property to "My Label" after the first post back. You see that now label's text property is "My Label" displayed on the page. Hit the button one more time. This time you will see that since the view state of label's control is disabled, asp.net set the default value of label's control "Label" instead of "My Label". Therefore when the 2nd post back occur we see "Label" on alert box .

Go ahead and turn on the view state of the label, first make sure the page's & Form's view state property is set to true too otherwise childlren control's view state property won't work.
Rerun the application and click on the button for first time to let the label change its text to "My Label".This time the alert box displayed "Label",which is expected. Click on button 2nd time. Aha! did you see that now asp.net retains the value of this label's text property and showed us "My Label"?
Do the same thing for textbox. Enable the viewstate property of textbox and try it. You won't find a difference. Confused?

Well this incident was reported back to Microsoft years ago and here is the justification of what Microsoft says about it. Please go ahead and read it thoroughly. Yes, there are 3 server controls i.e textbox, checkbox and radio button who retains their value from forms collection even if you disable the view state of them.But there are certain attributes of these control which can't function properly without Viewstate.

The articles says that this incident applies to .net 1.0 and 1.1. But for sure this works till 4.0. They just didn't get time to update it.