ValidateRequest="false" doesn't work in Asp.Net 4

Question

I have a form at which I use ckeditor. This form worked fine at Asp.Net 2.0 and 3.5 but now it doesn't work in Asp.Net 4+. I have ValidateRequest="false" directive. Any suggestions?

Answer 1

Found solution on the error page itself. Just needed to add requestValidationMode="2.0" in web.config

<system.web>
    <compilation debug="true" targetFramework="4.0" />
    <httpRuntime requestValidationMode="2.0" />
</system.web>

MSDN information: HttpRuntimeSection.RequestValidationMode Property

Answer 2

Note that another approach is to keep with the 4.0 validation behaviour, but to define your own class that derives from RequestValidator and set:

<httpRuntime requestValidationType="YourNamespace.YourValidator" />

(where YourNamespace.YourValidator is well, you should be able to guess...)

This way you keep the advantages of 4.0s behaviour (specifically, that the validation happens earlier in the processing), while also allowing the requests you need to let through, through.

Answer 3

After migration my application from dotnet framework 3.5 to 4.7, I get the same error.

Resolving it with adding requestValidationMode="2.0" to httpRuntime under system.web:

<httpRuntime maxRequestLength="2097151" requestValidationMode="2.0"/>

Answer 4

There is a way to turn the validation back to 2.0 for one page. Just add the below code to your web.config:

<configuration>
    <location path="XX/YY">
        <system.web>
            <httpRuntime requestValidationMode="2.0" />
        </system.web>
    </location>

    ...
    the rest of your configuration
    ...

</configuration>

Answer 5

This works without changing the validation mode.

You have to use a System.Web.Helpers.Validation.Unvalidated helper from System.Web.WebPages.dll. It is going to return a UnvalidatedRequestValues object which allows to access the form and QueryString without validation.

For example,

var queryValue = Server.UrlDecode(Request.Unvalidated("MyQueryKey"));

Works for me for MVC3 and .NET 4.

Answer 6

I found the solution here: https://www.aspsnippets.com/Articles/Solved-ValidateRequest-false-not-working-in-Net-40-and-45-in-ASPNet.aspx

Summary:

1. If you want to set this at page level, set ValidateRequest="false" like this <%@ Page Language="C#" AutoEventWireup="true" ValidateRequest="false" %>
2. You also need to modify httpRuntime to have requestValidationMode="2.0" or add it to <system.web> like this

<system.web>
    <httpRuntime maxRequestLength="91200" executionTimeout="9000" requestValidationMode="2.0" />
</system.web>

That works for me in .NET 4.8

Answer 7

I know this is an old question, but if you encounter this problem in MVC 3 then you can decorate your ActionMethod with [ValidateInput(false)] and just switch off request validation for a single ActionMethod, which is handy. And you don't need to make any changes to the web.config file, so you can still use the .NET 4 request validation everywhere else.

e.g.

[ValidateInput(false)]
public ActionMethod Edit(int id, string value)
{
    // Do your own checking of value since it could contain XSS stuff!
    return View();
}