Roadmap › 1. .NET › Step 17

ASP.NET Web Forms — Page Life Cycle, ViewState, Controls and State Management

How ASP.NET Web Forms works inside IIS (application and page life cycle), folder structure (App_Code, App_Data, App_Start, Bin, App_Themes), Web Site vs Web Application projects, .aspx/.aspx.cs code-behind, server controls and events, PostBack and ViewState, state management (ViewState, ControlState, Session, Application, Cache, cookies, query strings, hidden fields), validation controls, master pages, user controls and custom controls, data binding with GridView/Repeater and SqlDataSource vs ObjectDataSource, Global.asax and web.config, Forms authentication, custom errors, performance and migrating Web Forms to ASP.NET Core.

What it is & where it is used

ASP.NET Web Forms (2002, .NET Framework) lets developers build web pages the way they built Windows Forms: drag server controls onto a page, double-click a button and write a C#/VB.NET event handler. The framework hides HTTP's statelessness using PostBack (forms post to the same page) and ViewState (control state stored in a hidden field).

Strength	Weakness
Very fast development for data-entry/admin screens (GridView, FormView, validators)	Heavy pages (ViewState), less control over HTML
Event-driven model familiar to desktop developers	Hard to unit test (logic in code-behind)
Huge control ecosystem (Telerik, DevExpress, Infragistics)	Tightly coupled to IIS/System.Web; not in .NET Core
Still powers many enterprise/government intranets	No new features; migration needed for modern .NET

Web Forms remains supported on .NET Framework 4.8/4.8.1 (as part of Windows), so these apps keep running — and developers who understand them are needed for maintenance and migration. Community project WebFormsCore/Blazor migration tools exist, but there is no official Web Forms for .NET Core.

Versions & history

Version	Year	.NET Framework	Highlights
ASP.NET 1.0	2002	1.0	Web Forms, server controls, ViewState, code-behind, web.config, Forms auth
ASP.NET 1.1	2003	1.1	Mobile controls, request validation
ASP.NET 2.0	2005	2.0	Master pages, themes/skins, Membership/Roles/Profile providers, GridView/DetailsView/FormView, data source controls, Web Parts, `App_Code`, partial classes
ASP.NET 3.5	2007	3.5	ASP.NET AJAX (UpdatePanel, ScriptManager), ListView, LINQ, `LinqDataSource`; 3.5 SP1: Dynamic Data, routing (`System.Web.Routing`)
ASP.NET 4.0	2010	4.0	`ClientIDMode` (clean IDs), `ViewStateMode`, routing for Web Forms, `Response.RedirectPermanent`, cleaner HTML
ASP.NET 4.5	2012	4.5	Model binding (`SelectMethod`/`ItemType`), strongly typed data controls, async pages, bundling & minification, unobtrusive validation
ASP.NET 4.6 – 4.8	2015 – 2019	4.6 – 4.8	HTTP/2 support on Windows 10/IIS, async model binding, maintenance updates

Lifecycle

1. Application / request life cycle in IIS (integrated pipeline):

text

Browser → HTTP.sys → IIS (w3wp.exe, app pool, .NET CLR v4.0) → ASP.NET HttpRuntime
   → HttpApplication (Global.asax) events, run by HTTP modules:
     BeginRequest → AuthenticateRequest → AuthorizeRequest → ResolveRequestCache
     → MapRequestHandler → AcquireRequestState (Session loaded)
     → PreRequestHandlerExecute
     → HTTP HANDLER executes  (for .aspx: the Page class → PAGE LIFE CYCLE below)
     → PostRequestHandlerExecute → ReleaseRequestState (Session saved)
     → UpdateRequestCache → LogRequest → EndRequest
   → response sent

The first request to the application raises Application_Start (Global.asax); .aspx files are compiled dynamically (or precompiled) into classes deriving from your code-behind class, which derives from System.Web.UI.Page.

2. Page life cycle (the most-asked Web Forms interview topic):

Stage / event	What happens	Typical use
Page request & start	Determines `IsPostBack`, sets `Request`/`Response`	—
PreInit	Before controls initialise	Set master page or theme dynamically, create dynamic controls
Init	Each control's Init (children first), control IDs set	Initialise control properties, add dynamic controls
InitComplete	ViewState tracking turned on	—
(PostBack) Load ViewState / ControlState	Restore control values from `__VIEWSTATE`	—
(PostBack) Load PostBack data	Apply posted form values to controls	—
PreLoad	Before Load	—
Load	Page then each control's Load	Data loading — usually inside `if (!IsPostBack)`
Control events (PostBack)	`TextChanged`, `SelectedIndexChanged`, then the Button `Click` that caused the postback	Your business actions
LoadComplete	After events	—
PreRender	Last chance to change controls before rendering	Final UI adjustments
PreRenderComplete, SaveStateComplete	ViewState saved into `__VIEWSTATE`	—
Render	Each control writes its HTML (method, not event)	Custom controls override `Render`
Unload	Cleanup (children first, then page); response already sent	Close resources

Mnemonic: "SILVER" — Start, Init, Load, Validate, Event handling, Render (plus Unload).

Tools used to develop

Visual Studio 2022/2026 with the "ASP.NET and web development" workload (.NET Framework 4.8 templates) — designer view, Toolbox, Properties window.
IIS / IIS Express, IIS Manager, Event Viewer, Failed Request Tracing.
Third-party control suites: Telerik UI for ASP.NET AJAX, DevExpress ASP.NET Web Forms, Infragistics.
ViewState decoders (to inspect page size), browser DevTools, Glimpse (legacy), Application Insights / ELMAH for errors.
Migration: .NET Upgrade Assistant (project files), Blazor migration guides, YARP for incremental migration.