'Validation of viewstate MAC failed' on POST request using python requests

Viewed 203

I am sending POST request to subsequent pages in an aspx table using python-requests. Response: "b'306|error|500|Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.\r\n\r\nSee http://go.microsoft.com/fwlink/?LinkID=314055 for more information.|' "

I am able to do a successful POST request to login and retrieve the first page of results. The link for each of the subsequent pages is a '__doPostBack' JavaScript request. I am using the same logic to retrieve __VIEWSTATE, __EVENTVALIDATION, and __VIEWSTATEGENERATOR to pass with the POST request but getting the MAC error.

2nd page of results should be returned as if I had clicked on the following link in the page:

"javascript:__doPostBack('ctl00$ContentPlaceHolder1$TabControl1$ViewRecords1$OrderStatus1$DataGrid1$ctl01$ctl01','')"

import requests
from bs4 import BeautifulSoup

headers = { 'user-agent' : 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:67.0) Gecko/20100101 Firefox/67.0'}

with requests.Session() as s:
    url = "https://www.wavecontactlenses.com/waveioss/"
    r = s.get(url, headers=headers)
    soup = BeautifulSoup(r.content, 'html5lib')

    ##get view state value
    view_state = soup.find_all("input", {"id":"__VIEWSTATE"})[0]["value"]
    event_validation = soup.find_all("input", {"id":"__EVENTVALIDATION"})[0]["value"]
    view_state_generator = soup.find_all("input", {"id":"__VIEWSTATEGENERATOR"})[0]["value"]


    login_data = {
        '__EVENTTARGET' : '',
        '__EVENTARGUMENT' : '',
        '__VIEWSTATE' : view_state,
        '__VIEWSTATEGENERATOR' : view_state_generator,
        '__EVENTVALIDATION' : event_validation,
        'TextBoxUserId' : 'xxxxxxxx',
        'TextBoxPassword' : 'xxxxxx',
        'ButtonLogin' : 'login+to+WaveIOSS'
    }

    r = s.post(url, data=login_data, headers=headers)
    soup = BeautifulSoup(r.content, 'html5lib')
    #This request is successful and first page is displayed

    url = "https://www.wavecontactlenses.com/waveioss/main.aspx"

    ## get view state value
    view_state = soup.find_all("input", {"id":"__VIEWSTATE"})[0]["value"]
    event_validation = soup.find_all("input", {"id":"__EVENTVALIDATION"})[0]["value"]
    view_state_generator = soup.find_all("input", {"id":"__VIEWSTATEGENERATOR"})[0]["value"]

    target = 'ctl00$ContentPlaceHolder1$TabControl1$ViewRecords1$OrderStatus1$DataGrid1$ctl01$ctl02'

    login_data.clear()
    login_data = {
        'ct100$ScriptManager1' : 'ctl00$UpdatePanelPage|ctl00$ContentPlaceHolder1$TabControl1$ViewRecords1$OrderStatus1$DataGrid1$ctl01$ctl02',
        '__EVENTTARGET' : target,
        '__EVENTARGUMENT' : '',
        '__VIEWSTATE' : view_state ,
        '__VIEWSTATEGENERATOR' : view_state_generator,
        '__EVENTVALIDATION' : event_validation,
        '__ASYNCPOST' : 'true'
        'ct100@ContentPlaceHolder1$TabControl1$ViewRecords1$OrderStatus1$Status1' : 'LAB'
    }

    headers['Referer'] = r.request.url

##this request returns the MAC validation error
    r = s.post(url, data=login_data, headers=headers, cookies=r.cookies.get_dict())
    print(r.content)

1 Answers
  • you don't need to care about cookies if you use request.Session()
  • you can set common headers for session once via s.headers.update({'User-Agent': 'Mozilla...
  • check if you have __VIEWSTATEENCRYPTED on the click to the second page in the browser via developer tools -> Network, and post it with the fields set even if it's empty!
Related