view state encryption for visualforce pages

Question

Since visualforce pages are served over https connections, is view state encryption really required? How will this affect view state performance?

Answer 1

While the view state is communicated over the HTTPS pipe (hiding it from people outside the HTTPS session) the view state ends up as viewable text for the user (who created the HTTPS session). So if it wasn't encrypted, fields in your controller would be viewable by the user: at best exposing implementation detail and at worst exposing information that should be secret.

Another benefit of the view state being encrypted is that hacking of the view state content at the client-side (which would be very fragile) is effectively blocked.

As there is no option to encrypt or not encrypt the performance impact is not something that can be explored; the serialization of Apex objects and transmission of the view state are pretty expensive processes too.