Seaside[1] and (IIRC) arc[2] both do this too. My understanding was that __ViewState was intended to be encrypted in production by setting something in machine

Seaside[1] and (IIRC) arc[2] both do this too. My understanding was that __ViewState was intended to be encrypted in production by setting something in machine.config[3]. [1]: https://en.wikipedia.org/wiki/Seaside_(software) https://en.wikipedia.org/wiki/Seaside_(software) [2]: http://arclanguage.org/ http://arclanguage.org/ [3]: https://docs.microsoft.com/en-us/previous-versions/dotnet/articles/ms972976(v=msdn.10)?redirectedfrom=MSDN https://docs.microsoft.com/en-us/previous-versions/dotnet/ar...