>>But this only applies to event validation - you didn't clarify whether it was this excepion or 'Invalid ViewState'
>
>It was always invalid viewstate.
>
>But, I am using a machine static key now. So, we'll see how it goes.

So you got an 'Invalid ViewState' exception when the EnbableViewState property was set to false? That sounds like a .NET bug....

Also bear in mind, if this is a production server, that the exceptions are doing exactly what they are intended to do - alerting you to the fact that a client was deliberately returning invalid postback information....