Introduction:
Cross Site Scripting(XSS) and Cross-Site Request Forgery (CSRF) attacks are one of dangerous attacks on
web. They are among the most famous security issues affecting
web applications. OWASP regards XSS is the number one security issue on the
Web. Both ASP.NET
Web Forms and ASP.NET MVC paid very much attention
to make applications build with ASP.NET as secure as possible. So by default they will throw an exception 'A potentially dangerous XXX value was detected from the client', when they see, < followed by an exclamation(like <!) or < followed by the letters a through z(like <s) or & followed by a pound sign(like {) as a part of querystring, posted form and cookie collection. This is good for lot of applications. But this is not always the case. Many applications need
to allow users
to enter html tags, for example applications which uses Rich Text Editor. You can allow user
to enter these tags by just setting validateRequest="false" in your
Web.config application configuration file inside <pages> element if you are using
Web Form. This will globally disable request validation. But in ASP.NET MVC request handling is different than ASP.NET
Web Form. Therefore for disabling request validation globally in ASP.NET MVC you have
to put ValidateInputAttribute in your every controller. This become pain full for you if you have hundred of controllers. Therefore in this article i will present a very simple way
to handle request validation globally through
web.config. Description:
Before starting how
to do this it is worth
to see why validateRequest in Page directive and
web.config not work in ASP.NET MVC. Actually request handling in ASP.NET
Web Form and ASP.NET MVC is different. In
Web Form mostly the HttpHandler is the page handler which checks the posted form, query string and cookie collection during the Page ProcessRequest method, while in MVC request validation occur when ActionInvoker calling the action. Just see the stack trace of both framework. ASP.NET MVC Stack Trace: System.
Web.HttpRequest.ValidateString(String s, String valueName, String collectionName) +8723114 System.
Web.HttpRequest.ValidateNameValueCollection(NameValueCollection nvc, String collectionName) +111 System.
Web.HttpRequest.get_Form() +129 System.
Web.HttpRequestWrapper.get_Form() +11 System.
Web.Mvc.ValueProviderDictionary.PopulateDictionary() +145 System.
Web.Mvc.ValueProviderDictionary..ctor(ControllerContext controllerContext) +74 System.
Web.Mvc.ControllerBase.get_ValueProvider() +31 System.
Web.Mvc.ControllerActionInvoker.GetParameterValue(ControllerContext controllerContext, ParameterDescriptor parameterDescriptor) +53 System.
Web.Mvc.ControllerActionInvoker.GetParameterValues(ControllerContext controllerContext, ActionDescriptor actionDescriptor) +109 System.
Web.Mvc.ControllerActionInvoker.InvokeAction(ControllerContext controllerContext, String actionName) +399 System.
Web.Mvc.Controller.ExecuteCore() +126 System.
Web.Mvc.ControllerBase.Execute(RequestContext requestContext) +27
ASP.NET
Web Form Stack Trace: System.
Web.HttpRequest.ValidateString(String s, String valueName, String collectionName) +3213202 System.
Web.HttpRequest.ValidateNameValueCollection(NameValueCollection nvc, String collectionName) +108 System.
Web.HttpRequest.get_QueryString() +119 System.
Web.UI.Page.GetCollectionBasedOnMethod(Boolean dontReturnNull) +2022776 System.
Web.UI.Page.DeterminePostBackMode() +60 System.
Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +6953 System.
Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +154 System.
Web.UI.Page.ProcessRequest() +86
Since the first responder of request in ASP.NET MVC is the controller action therefore it will check the posted values during calling the action. That's why
web.config's requestValidate not work in ASP.NET MVC. So let's see how
to handle this globally in ASP.NET MVC. First of all you need
to add an appSettings in
web.config. <appSettings> <add key="validateRequest" value="true"/> </appSettings> I am using the same key used in disable request validation in
Web Form. Next just create a new ControllerFactory by derving the class from DefaultControllerFactory. public class MyAppControllerFactory : DefaultControllerFactory { protected override IController GetControllerInstance(Type controllerType) { var controller = base.GetControllerInstance(controllerType); string validateRequest=System.Configuration.ConfigurationManager.AppSettings["validateRequest"]; bool b; if (validateRequest != null && bool.TryParse(validateRequest,out b)) ((ControllerBase)controller).ValidateRequest = bool.Parse(validateRequest); return controller; } } Next just register your controller factory in global.asax. protected void Application_Start() { //............................................................................................ ControllerBuilder.Current.SetControllerFactory(new MyAppControllerFactory()); } This will prevent the above exception
to occur in the context of ASP.NET MVC. But if you are using the Default WebFormViewEngine then you need also
to set validateRequest="false" in your
web.config file inside <pages> element Now when you run your application you see the effect of validateRequest appsetting. One thing also note that the ValidateInputAttribute placed inside action or controller will always override this setting. Summary: Request validation is great security feature in ASP.NET but some times there is a need
to disable this entirely. So in this article i just showed you how
to disable this globally in ASP.NET MVC. I also explained the difference between request validation in
Web Form and ASP.NET MVC. Hopefully you will enjoy this.
