title: Can the EVENTVALIDATION field be tampered with?
body: <p>Is it possible to decode, and thus tamper with, the rendered _EVENTVALIDATION field?  I found a lot of information about what it DOES, but couldn't find anything that actually says whether or not the value itself is protected against tampering.  I did attempt to base64 decode it and got gibberish back, so I'm assuming that it is in fact encrypted, but if someone knows for sure and can verify that, that would be awesome.</p>
  
  <p>I do know that Viewstate is not encrypted (although you can set it to be).  I'm not as interested in that, I'm just interested in eventvalidation.</p>
  
  <p>I found a similar question: <a href="https://stackoverflow.com/questions/1092697/is-it-possible-to-decode-eventvalidation-and-viewstate-in-asp-net">Is it possible to decode EventValidation and ViewState in ASP.NET?</a> but no one seemed to have a specific answer regarding the event validation field.</p>
  
  <p>Concrete example: I have a dropdown of available reports that the user can run. It's populated with some "members" reports but also some "Admin only" reports which are rendered during OnLoad, and only adds them if the user is an Admin.  When the page posts back, can I trust the event validation routine to be secure and that the user has not injected an "admin only" report into the list of acceptable values, or should I re-check permissions in my postback handler to verify the user can actually use the report that was selected?</p>