I'm implementing a payment gateway, and it basically works like this:
User will do their shopping at my site, and view Cart.aspx. Cart.aspx will post the form to the payment gateway.
The payment gateway will process the payment, and then do a post back to my server at Response.ashx. It posts the details of the credit card transaction, but it will also re-post whatever I gave it. So it is giving me back a __ViewState field. (ViewState, EventValidation, RequestValidation are all disabled on both Cart.aspx, and Order.aspx, which is the page being redirected to.)
Response.ashx has the following code:
public class Response: IHttpHandler, IRequiresSessionState
{
public void ProcessRequest( Go to the complete details ...