The DSA- and a rather broken website

I've been receiving numerous complaints from people over the last couple of months about error messages on the DSA website.

You'll be navigating the website and then suddenly receive a message saying

Invalid navigation!

You are attempting to use an invalid path through the booking application

Please click here to return to the booking homepage

What's even more annoying- is that the link to contact the site administrator goes to "dsawebmaster@driving-tests.info" . Which is just a made up address on a non-existent domain.

If this happens to you- the best way to contact the DSA is by emailing customer.services@dsa.gsi.gov.uk . Though they generally take around 10 days to reply. Hardly sterling customer service.

For those of a more technical bent- I've worked out why their website throws these random errors...

Inspecting the HTTP Response headers I see the following:

1. Cache-Control:
   private
2. Content-Length:
   13044
3. Content-Type:
   text/html; charset=utf-8
4. Date:
   Sun, 06 Mar 2011 16:25:08 GMT Sun, 06 Mar 2011 16:25:08 GMT
5. X-PoolMember:
   2 2
6. X-Powered-By:
   ASP.NET ASP.NET

The item of interest here is X-PoolMember. This suggests to me that they are using a number of load balanced webservers. The X-Powered-By header informs us they are using ASP.NET and this is confirmed by the "VIEWSTATE" fields we see on the forms:

ASP.Net uses these viewstate fields to keep track of form state. But in order to prevent tampering by the client, they are encrypted.

Now, by default each web server will use its own encryption key to encrypt and decrypt the viewstate (http://msdn.microsoft.com/en-us/library/ms972427.aspx for details).

This means that if you get an HTTP Response from one of the web servers, and your request is handled by a different web server, the second webserver will be unable to decrypt the viewstate fields (as they are using different encryption keys) and will throw an error.

To fix this the DSA need to add a setting like this:

 machinekey validation="SHA1" validationkey="  F3690E7A3143C185AB1089616A8B4D81FD55DD7A69EEAA3B32A6AE813ECEECD28DEA66A 23BEE42193729BD48595EBAFE2C2E765BE77E006330BC3B1392D7C73F"  

to all their web.configs, in order to ensure that all the web servers are using the same validation key. Then we not see quite so many errors being returned quite so much of the time from their website. DSA Techies- if you read this, feel free to pop a cheque in the post!