Comment by glassx

It's been a while since I last had to parse ASP.NET pages, but AFAIK, the viewstate isn't meant to be parsed by clients, you just have to re-send it during postbacks. It's more like a cookie, or Rails' authenticity_token [1].

[1] http://stackoverflow.com/questions/941594/understand-rails-a...

EDIT: Oh, ok. Re-reading the article, he was parsing the ViewState because there was some data hidden in there (a serious flaw actually), instead of scraping the site normally! Clever!