Introduction:
Cross Site Scripting(XSS) and Cross-Site
Request Forgery (CSRF) attacks are one of dangerous attacks on web. They are among the most famous security issues affecting web applications. OWASP regards XSS is the number one security issue on the Web. Both ASP.NET Web Forms and ASP.NET MVC paid very much attention to make applications build with ASP.NET as secure as possible. So by default they will throw an exception 'A potentially dangerous XXX value was detected from the client', when they see, < followed by an exclamation(like <!) or < followed by the letters a through z(like <s) or & followed by a pound sign(like {) as a part of querystring, posted form and cookie collection. This is good for lot of applications. But this is not always the case. Many applications need to allow users to enter html tags, for example applications which uses Rich Text Editor. You can allow user to enter these tags by just setting validateRequest="false" in your Web.config application configuration file inside <pages> element if you are using Web Form. This will globally disable
request validation. But in ASP.NET MVC
request handling is different than ASP.NET Web Form. Therefore for disabling
request validation globally in ASP.NET MVC you have to put ValidateInputAttribute in your every controller. This become pain full for you if you have hundred of controllers. Therefore in this article i will present a very simple way to handle
request validation globally through web.config. Description:
Before starting how to do this it is worth to see why validateRequest in Page directive and web.config not work in ASP.NET MVC. Actually
request handling in ASP.NET Web Form and ASP.NET MVC is different. In Web Form mostly the HttpHandler is the page handler which checks the posted form, query string and cookie collection during the Page ProcessRequest method, while in MVC
request validation occur when ActionInvoker calling the action. Just see the stack trace of both framework. ASP.NET MVC Stack Trace: System.Web.HttpRequest.ValidateString(String s, String valueName, String collectionName) +8723114 System.Web.HttpRequest.ValidateNameValueCollection(NameValueCollection nvc, String collectionName) +111 System.Web.HttpRequest.get_Form() +129 System.Web.HttpRequestWrapper.get_Form() +11 System.Web.Mvc.ValueProviderDictionary.PopulateDictionary() +145 System.Web.Mvc.ValueProviderDictionary..ctor(ControllerContext controllerContext) +74 System.Web.Mvc.ControllerBase.get_ValueProvider() +31 System.Web.Mvc.ControllerActionInvoker.GetParameterValue(ControllerContext controllerContext, ParameterDescriptor parameterDescriptor) +53 System.Web.Mvc.ControllerActionInvoker.GetParameterValues(ControllerContext controllerContext, ActionDescriptor actionDescriptor) +109 System.Web.Mvc.ControllerActionInvoker.InvokeAction(ControllerContext controllerContext, String actionName) +399 System.Web.Mvc.Controller.ExecuteCore() +126 System.Web.Mvc.ControllerBase.Execute(RequestContext requestContext) +27
ASP.NET Web Form Stack Trace: System.Web.HttpRequest.ValidateString(String s, String valueName, String collectionName) +3213202 System.Web.HttpRequest.ValidateNameValueCollection(NameValueCollection nvc, String collectionName) +108 System.Web.HttpRequest.get_QueryString() +119 System.Web.UI.Page.GetCollectionBasedOnMethod(Boolean dontReturnNull) +2022776 System.Web.UI.Page.DeterminePostBackMode() +60 System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +6953 System.Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +154 System.Web.UI.Page.ProcessRequest() +86
Since the first responder of
request in ASP.NET MVC is the controller action therefore it will check the posted values during calling the action. That's why web.config's requestValidate not work in ASP.NET MVC. So let's see how to handle this globally in ASP.NET MVC. First of all you need to add an appSettings in web.config. <appSettings> <add key="validateRequest" value="true"/> </appSettings> I am using the same key used in disable
request validation in Web Form. Next just create a new ControllerFactory by derving the class from DefaultControllerFactory. public class MyAppControllerFactory : DefaultControllerFactory { protected override IController GetControllerInstance(Type controllerType) { var controller = base.GetControllerInstance(controllerType); string validateRequest=System.Configuration.ConfigurationManager.AppSettings["validateRequest"]; bool b; if (validateRequest != null && bool.TryParse(validateRequest,out b)) ((ControllerBase)controller).ValidateRequest = bool.Parse(validateRequest); return controller; } } Next just register your controller factory in global.asax. protected void Application_Start() { //............................................................................................ ControllerBuilder.Current.SetControllerFactory(new MyAppControllerFactory()); } This will prevent the above exception to occur in the context of ASP.NET MVC. But if you are using the Default WebFormViewEngine then you need also to set validateRequest="false" in your web.config file inside <pages> element Now when you run your application you see the effect of validateRequest appsetting. One thing also note that the ValidateInputAttribute placed inside action or controller will always override this setting. Summary:
Request validation is great security
feature in ASP.NET but some times there is a need to disable this entirely. So in this article i just showed you how to disable this globally in ASP.NET MVC. I also explained the difference between
request validation in Web Form and ASP.NET MVC. Hopefully you will enjoy this.
