How to protect view state from tampering when it's passed over an unencrypted channel ?
-
In Page directive set EnableViewStateMac="true"
-
In Register directive set EnableViewStateMac="true"
-
In web config set Protectviewstate="true"
-
In IIS set Viewstate protection.
ViewStateMAC (Message Authentication Code) adds a cryptographic hash to view state data, detecting tampering when the data往返s over unencrypted channels. Setting EnableViewStateMac="true" in the Page directive enables this protection. The Register directive is for user controls (not page-level settings), web.config uses different attributes, and IIS doesn't have ViewState-specific protection.
To protect view state from tampering when it's passed over an unencrypted channel, you can set the "EnableViewStateMac" attribute to "true" in the Page directive.
Option A) In Page directive set EnableViewStateMac="true" - This option is correct because by setting the "EnableViewStateMac" attribute to "true" in the Page directive, it enables the use of a message authentication code (MAC) to verify the integrity of the view state. This helps protect against tampering.
Option B) In Register directive set EnableViewStateMac="true" - This option is incorrect. The "Register" directive is used to register custom controls, and it does not have an "EnableViewStateMac" attribute.
Option C) In web config set Protectviewstate="true" - This option is incorrect. The "ProtectViewState" attribute in the web.config file is used to enable or disable view state validation, which helps protect against tampering, but it does not specifically address passing view state over an unencrypted channel.
Option D) In IIS set ViewState protection - This option is incorrect. IIS (Internet Information Services) does not have a specific setting for protecting view state. View state protection is typically handled within the application code or configuration.
The correct answer is A) In Page directive set EnableViewStateMac="true". This option enables the use of a message authentication code (MAC) to protect the view state from tampering when passed over an unencrypted channel.