In the Login page works perfect, but when i click Login and i on the Safari our Internet Explorer, or sometimes even in the google chrome when i send the link to someone, i receive this two erros:

Error Deserializing ViewState of page "ASP.login_aspx", visitorid "388e1073-8b48-4ac8-abe3-27ed27fb01b0", size 640 bytes ("5ctelhMDLY...").
Cannot decrypt the content

Or 

Cannot decrypt the content

Hi Vinicius,

"Error deserializing viewstate" may happen if you make changes to your application and publish those changes, and you do not refresh the web page in the browser. But I assume in your case this is not the case?

Hi.


I'm getting the same error. Don't have it on the dev or test server but happens on the prod server. All of them are on premise and this is happening when my users are using the FullCalendar module. 

I saw on a thread somewhere that this could happen because of JS on the page but I only have Widget_Click in the preperation and nothing more.

Any ideas?

With best regards,

Íris

I got the same error too, and it only happens in IE11 Enterprise mode in Windows 7.


Hi,


Does someone reached the solution? I am experiencing the same.


Best Regards.

Hi Luis,

Do you also have the "decrypt content" problem, or a generic "error deserializing viewstate"?

I have also the decrypt content problem.


Bummer. I recently had one followe by "Object reference not set to an instance of an object.", but I have no solution for the encryption one.

I' am also having the "Error Deserializing ViewState...Cannot decrypt the content" error. The servers are on premise and it happens on all of them...

I haven't had this exception myself, but I do recognize it from my .NET days.

In a load balanced environments where there are multiple servers there was a need to set the machine key in the machine.config file in order to encode and decode the viewstate with the same key instead of one generated on each machine individually. When you didn't set this, you would get similar exceptions as the ones mentions above. 

I didn't see this mentioned in the platform installation guideline, but who knows it might help. To configure the machine key and see if that solves the issue you can use the following post: https://serverfault.com/questions/445609/add-machine-key-to-machine-config-in-load-balancing-environment-to-multiple-vers

Hello,

Any solution for this ?

Hi,

I do not know if what I'm going to say corresponds 100% to doubt. I found some posts on the subject, and I saw people saying the following: "The issue is due to an incompatibility between the objects that were cached in the ViewState (in the browser) and the new version of those objects in the server.You can workaround that error by publishing the full solution." 

I hope to help,

Bernardo

Updating:

I just managed to simulate this error, and it happened when I was on a screen that receives input parameters, and in its URL there were no parameters, just the empty URL, clicked on that URL and then ENTER to refresh the page, instead of F5, the error occurred.


How did I solve it?

My screen is directed through a flow, because I need to perform actions before going to the screen. However, my action was like submit, it was directed to the screen, it did not change the URL, and when it changed, the parameters did not appear, as I said before. I changed from Submit to Ajax Submit, and the error stopped happening. That is, my screen that has input parameters, expected them to come in the URL, as it did not come, it accused me the error.


I hope to help

Hi,


Did anyone managed to find the concrete solution to above issue. 


Thanks

Atul

Hi,


The only way I managed to replicate this problem is opening a page, clearing the cookies and click a button in the page without reloading it first. This is expected since one of the viewstate protections is to prevent other users from using your viewstate in an attack. But this is a very edge case that I doubt everyone is doing.


@Bernardo can you replicate the problem consistently with that procedure? Can you upload a module that does it? I must be missing something.


For everyone having this issue:

- what browser? Normal mode or incognito?

- what page? Always the login?

- are there any iframes involved?

- can the error be replicated multiple times? or just once?

- is it causing errors visible to the user or just on the logs?

- if any support cases were open can you tell me the numbers (can be via personal message) so I can followup?


Regards,

João Rosado

Hi,

I don't think this is a code issue since I am getting the same error in all the pages and also to note that when I am trying to open the page using localhost this issue does not happen. 


It is definitely a environment issue that needs attention. 


Thanks

Atul 

Have you looked at Joris van Geffen's post? This is a common issue with load balances IIS servers that do not have the same machine key. It would explain why it's happening in a Production environment but not debug or when using localhost as there won't be multiple servers in those cases (that is assuming your production environment has multiple front end servers).


Hi, 


So I would like to know if the solution provided by Joris van Geffen actually works and also why outsystems does not handles this scenario out of the box. 


Thanks 

Atul 

Are you using a self hosted or Outsystems PaaS hosted version? The PaaS certainly should handle it out of the box. For self hosted I assume that would be part of the setup instructions unless Outsystems has a config for it. Don't know if that is the actual solution but as Joris said it looks very similar to issues I have had when using .net load balanced web servers in the past.


It cannot be the machine key issue since OutSystems viewstate does not use that, in part to avoid those kinds of problems.


But anyway adding to my above questions:

- how many frontends do you have


@Atul do you have any support ticket open or may I contact you about this?


Regards,

João Rosado

Hi João,

We are having these exact same errors on our QA and PRD (load balanced) environments.

  • QA exists of two front ends: one internal and one in DMZ.
  • PRD exists of three front ends: one internal and two in DMZ.

I have noticed something that may be important. Only the front ends in the DMZ produce this error in our case. Both on QA and PRD.

I have no support case open at this moment, but you may contact me for further info and log files.

Kinds regards,
Nordin

João Rosado wrote:

It cannot be the machine key issue since OutSystems viewstate does not use that, in part to avoid those kinds of problems.


But anyway adding to my above questions:

- how many frontends do you have


@Atul do you have any support ticket open or may I contact you about this?


Regards,

João Rosado

Hi, 


I have two frontends. Not yet created support ticket. 


Thanks

Atul 


Thanks for the availability, 

I'm currently still evaluating the current support tickets and possible scenarios that could lead to the error.


In the meanwhile if anyone with the problem could answer the above questions it would be great.


Regards,
João Rosado

We have 3 front-end servers running multiple applications. The B2B application hardly has this problem, the B2C one does. Also, no support ticket yet.

Hi, after a research on the subject it appears that most of the root causes are either related to:


  • The application being using inside an iframe on Internet Explorer or Safari
  • Using platform versions between 10.0.823.0 and 10.0.912.0 (or 11.0.200.0 in case of O11).


Do all the reports here fall into one of those 2 categories?


Regards,
João Rosado

Hi,

We are also getting both the Error Deserializing ViewState and Cannot decrypt the content.  These errors occur together.

  • Version 10.0.904.0
  • Occurs only on two front-end production servers (not on dev and uat)
  • Receiving error in multiple applications
  • Error does not always occur with iframe
  • Not sure which browsers yet
  • Servers are hosted locally

Thanks so much for discussing this issue.  We would also like to resolve these errors.  Let us know if we can provide more information.

Hello,


I got involve on investigating this kind of error on one of our customers. I cannot reproduce this error from my end and focused on the Service Center logs which showed XFF header to those request that had this error. The theory I had is that there's a proxy server involve in caching the page in which could have affected the content of the viewstate. The solution I recommended is to set the cache-control to no-cache by making use of the AddHeader action inside Common/Layout. Unfortunately, this solution was not proven yet because it only happened to one user and we weren't able to verify the solution as of the moment. While this solution has some performance implication, I think it can be invoked only to those clients that has x-forwarded-for header. 


If your logs shows XFF, I think the said solution is worth to try.


Regards,

John



João Rosado wrote:

Hi, after a research on the subject it appears that most of the root causes are either related to:


  • The application being using inside an iframe on Internet Explorer or Safari
  • Using platform versions between 10.0.823.0 and 10.0.912.0 (or 11.0.200.0 in case of O11).


Do all the reports here fall into one of those 2 categories?


Regards,
João Rosado

Hi João,

One of those categories seems to be the case over here. We're running platform version 10.0.900.0.
So did this error disappear with upgrading the platform version in the cases you have found?

Regards,
Nordin


Hi,

We are indeed also running on 10.0.900.0 and some of the errors might occur in pages running within an iframe. But other pages which aren't loaded in an iframe throw the same exception.

Hi João/Team,


Did we have a solution to this issue with a concrete root cause since I have started to get this issue 9n higher environment as well. 


To note, this issue is happening only on intranet zone. 


Thanks 

Atul Patel 

I've seen these errors on a daily basis for some public users.

I worked with outSystems support to figure out what causes these errors. Turns out these users had cookies disabled.

Once they enabled cookies the "Error Deserializing viewState of page xxxx" and "Cannot decrypt the content" errors stopped occurring.

Hope this helps some of you.

Thanks.

Fabian