Request Validation in ASP.NET 4.0
- by Ben Bastiaensen
Up to ASP.NET 3.5 Request Validation is enabled by default. In order to to disable this for a page you needed to set the ValidationRequest property in the page directive to false.
This is no longer the default case in ASP.NET 4.0. If you want to use this behaviour you need to add the follwing setting in web.config
<httpRuntime requestValidationMode="2.0" />
Of course you need to check all input in the page for XSS or other malicious input if you set the pages request validation to false.