Since visualforce pages are served over https connections, is view state encryption really required? How will this affect view state performance?

1 Answer 1


While the view state is communicated over the HTTPS pipe (hiding it from people outside the HTTPS session) the view state ends up as viewable text for the user (who created the HTTPS session). So if it wasn't encrypted, fields in your controller would be viewable by the user: at best exposing implementation detail and at worst exposing information that should be secret.

Another benefit of the view state being encrypted is that hacking of the view state content at the client-side (which would be very fragile) is effectively blocked.

As there is no option to encrypt or not encrypt the performance impact is not something that can be explored; the serialization of Apex objects and transmission of the view state are pretty expensive processes too.

  • Most of the data we would want to display to user on VF page tough.
    – zuke
    Commented Aug 10, 2015 at 17:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .