Every once in a while I notice my site goes into a cookieless state, although I don’t have this option specified in my web.config. In addition my ASP.NET Menu control shows all the menu items although I have specific roles attached to some menu items.
It seems the site is still secure because if the user clicks on a menu item thats role specific it will redirect them to the login page.
I also noticed in Elmah there are a lot of Invalid Viewstate error messages on my registration and login pages. I assumed I am being hacked. Any tips on how to prevent this?
Thank you!
“although I don’t have this option specified in my web.config. “
Are you sure? Because what you are describing sure sounds like this mode: