title: What is the purpose of __EVENTVALIDATION __VIEWSTATE in aspx?
body: <p>Consider:</p>
  
  <pre><code>Content-Disposition: form-data; name="__VIEWSTATE"
  
  /wEPDwUKMTQxNzIxMTc0MQ9kFgICAw8WAh4HZW5jdHlwZQUTbXVsdGlwYXJ0L2Zvcm0tZGF0YWRkflsROmXoLo8ar8ukWWYDh1Wr2BCwmhiAAqpX/xwqLq8=
  
  Content-Disposition: form-data; name="__EVENTVALIDATION"
  
  /wEWBgKJ1KD6AwKH3P+GBQLr/4HeAgKWoZqyCQLinqurDALt3oXMA0YLgb/Mt6KGihl+8ixYoY9A24wgHGGoPAINhuyP7nEl
  </code></pre>
  
  <p>We make a site where users can upload photos. Later we decided that users can also upload photos via other applications, and we like to have a uniform interface. So the other applications work with the same page.</p>
  
  <p>We notice that we cannot upload photos unless we know the value of __EVENTVALIDATION and __VIEWSTATE.</p>
  
  <p>Of course, the application can just load the uploading image, but that's kind of a hassle.</p>
  
  <p>What are those for anyway? Is there a way to upload images to aspx upload web without specifying things?</p>