Question: we know that view state is easily get abused, but asp.net webform are heavily depending on this feature.

I want to know whether you disable viewstate by default, and ONLY add it wehn it's needed. Or you take the visual studio default, which actually enables viewstate by default.

Answer: 
Turn off the ViewState by default by using a `<page>` element in the web.config. Using `EnableViewState="true"` in the `@Page` directive will no longer work once you disable the ViewState in the web.config. If you decide later that you need the ViewState for a specific page, you can turn it back on for just that page using a `<location>` element.

```
<configuration>
  <system.web>
    <pages enableViewState="false" />
  </system.web>

  <location path="MyFolder/MyPage.aspx">
    <system.web>
      <pages enableViewState="true" />
    </system.web>
  </location>
  <location path="Site.master">
    <system.web>
      <pages enableViewState="true" />
    </system.web>
  </location>
</configuration>

```

You need to do the same for any master pages that your ViewState enabled page uses.
I go one step further, I've created a class that inherits from the Page class and override 2 functions 

```
protected override void SavePageStateToPersistenceMedium(object viewState) 
{
}

protected override object LoadPageStateFromPersistenceMedium()
{
 return null;
}

```

Then have my page that requires the viewstate to be disabled inherit from this.
Works very well.