W3C home > Mailing lists > Public > www-talk@w3.org > March to April 2008

Re: __VIEWSTATE encoding

From: Ian Clelland <ian@veryfresh.com>
Date: Thu, 3 Apr 2008 10:10:10 -0700
Message-ID: <5e215be10804031010j69cbe6ebp5a627504ea0103b0@mail.gmail.com>
To: "Andre Kirchner" <supercroc1974@yahoo.com>
Cc: www-talk@w3.org

These are the relevant bits of POST data from your original message:

1st sample:

2nd sample:
> __VIEWSTATE=%2FwEPDwUJMjM0ODU1MzMxD2QWAgIDD2QWCm  ... [continues for much

BOTH of these are encoded, according to the content-type:
> Content-Type: application/x-www-form-urlencoded

In the first example, there are no characters which need to be escaped, so
the encoded value is the same as the unencoded value. In the second example,
at least the first character was escaped -- %2F is the encoding of a slash
("/") character.

If you want a standard to read, try section 2.3 of RFC 3875 (CGI 1.1), or
section 2.4 of RFC 2396 (URI syntax). The issue is really about HTML forms,
though, rather than HTTP.
http://www.w3.org/TR/html401/interact/forms.html#h-17.13.4 has the
definitive answer from the HTML side.

The short answer, though, is that the POST data should ALWAYS be encoded,
and you should run whatever you receive through a urldecode function before
using it.

Ian Clelland

On Sun, Mar 23, 2008 at 8:38 PM, Andre Kirchner <supercroc1974@yahoo.com>

> I was tapping my browser POST messages to a calendar, and noticed that the
> first message has an uncoded __VIEWSTATE, while the next messages seem to
> have it encoded (See bellow). How can a web server know that if a message
> has its __VIEWSTATE encoded or not? Because I didn't find anything in the
> headers about it. Would it be that a encoded message starts with "%2F", and
> an uncoded one not? Is there a RFC about it, if so which one?
Received on Thursday, 3 April 2008 17:10:59 UTC

This archive was generated by hypermail 2.3.1 : Tuesday, 6 January 2015 21:33:07 UTC