<pages validateRequest=“false” /> and <httpRuntime requestValidationMode=“2.0” /> not working

Question

I've inherited an MVC asp.net app using framework 4.0.

I'm getting the dreaded "A potentially dangerous Request.Form value was detected from the client" error and all my research leads me to believe that this should fix it:

<system.web>
    <httpRuntime requestValidationMode="2.0" />
    <pages validateRequest="false" />
</system.web>

However, I've added that to my web.config and still get the error. I'm at the end of my rope here, what am I missing?

Answer 1

In addition to what you did you also have to decorate your methods with the ValidateInput attribute.

[ValidateInput(false)]
public ActionResult MyActionMethod(string myParameter)
{
    // Method implementation goes here... 
}

There is an alternative though, you can implement your own request validator and bind that in your web.config if you want to handle validation for your entire site. Take a look at this blog post on how to fully implement it.

Basically, create a class that inherits from RequestValidator and then hook it up on the web.config.

<httpRuntime requestValidationType=”Globals.CustomRequestValidation”/>

Hopefully this helps!

Answer 2

Take another approach. In the httpRuntime, point to your custom validation class. This way have the complete control over incoming requests as the validator is fired upon each single request, at the beginning of the processing pipeline.

In particular, if you implement your validator to return true, you will unconditionally accept all incoming requests.

http://msdn.microsoft.com/en-us/library/system.web.util.requestvalidator.aspx

Answer 3

The simplest way is to remove the characters you want from the validation system.

Here is the requestPathInvalidCharacters attribute from the httpRuntime element with its default value.

<httpRuntime requestPathInvalidCharacters="&lt;,&gt;,*,%,&amp;,:,\" />
<!-- the unescaped characters are: < > * % & : \  -->

Remove the characters you want to authorize and the request will work.