Click here to Skip to main content
15,120,639 members
Articles / Web Development / ASP.NET
Posted 2 Apr 2012

Tagged as


19 bookmarked

Examining Request Validation with ASP.NET 4.5

Rate me:
Please Sign up or sign in to vote.
4.88/5 (11 votes)
3 Apr 2012CPOL8 min read
In this article, we’ll discuss the Request Validation changes in ASP.NET 4.5. Also we’ll dig it more with few examples

Security is always the one of the greatest concerns of Applications and when it comes to web applications, they are more prone to security breach. Several web technologies available, provides many features that is used to write secured web applications.

Here In this article, I am going to discuss Request Validation feature, mainly focusing ASP.NET 4.5 version.

Request validation introduced since ASP.NET 1.1 is available. By default it is enabled and it prevents to accept un-encoded HTML/XML etc from Client to server. It validates all the data that is passed from client to server. It can be any form like

  • Cookies
  • Form Collection
  • Querystring
  • Server variables

This helps to avoid script injection attacks. So it is always recommended to validate all the data that is passed from client to server because it can be malicious code and can be harmful the application.

Although, if we are sure that this situation would not arise, it can be disabled at application level or page level so no request will get validated. But this is not the case every time. On some occasions, we may need to allow users to enter some html, xml etc.. data . In this case, we need to partially validate the request.

There are several scenarios where we need to turn off the request validation just because of some specific data we don’t need to get validated. It leads us to write less secure code because we are the whole request goes to unvalidated. There are scenarios like in blog sites where we normally allow the user to write html , xml etc as input.

Till ASP.NET 4.0, we have option to disable the request validation in the entire application or can be done page by page. But till now we did not have option to partially validate the page. ASP.NET 4.5 enables us to validate some specific part of the request.

ASP.NET 4.5 provides us two features.

  • Selectively un-validate the request
  • Deferred or lazy validation

How to allow unvalidated request in 4.5

I have created a sample application and have two textboxes - txtValidate and txtunValidate, with a submit button.

Let's have a use case that I want to validate txtValidate but not txtunValidate. You must remember that this was not possible with earlier version of ASP.NET.I'll also discuss it in detail later. To use this feature , you must set requestValidationMode as 4.5 in web.config like

<httpruntime requestvalidationmode="4.5" />
Apart from this, ASP.NET 4.5 added one more property ValidateRequestMode with input controls. And it can have the following values
  • Enabled: Request validation is enabled for the control. Bydefault it is enabled
  • Disabled: Input values for this control would not be validated
  • Inherit: Property value will be inherited from parent

So lets proceed with sample, and as I don’t want to validate txtunValidate so I need to set ValidateRequestMode attribute as disabled like

Image 1

Now Let's run the code.

Image 2

And as you can see I've put some script tag in txtunValidate and it worked fine. But let us remove the requestValidationMode from web.config and try to submit the same input again.

Image 3

and see it gave the HttpRequestValidationException exception and got the above screen. Now lets again put the attribute requestValidationMode in web.config and try to put some script in txtValidate and submit. It'll show you the same exception again as expected. So here you can see, ASP.NET 4.5 enables us to selectively validate the request.

Deferred or lazy validation

This is also introduced in 4.5 and I'll say that above feature is just a corollary of this feature.

To provide these features, Microsoft has done some major changes in the way Request Validation feature got implemented in earlier version of ASP.NET. As we know, to process a request, ASP.NET creates an instance of HTTPContext which holds the instance of HTTPRequest and HTTPResponse with other required data. All the input data that is passed from client to server, it is posted in form collection, querystring etc.. ASP.NET validates every data that is passed from client.

Actually in ASP.NET 4.5, whenever the data is accessed from the request it gets validated. Like when we access the form collection to some input as Request.Form[uniqueId] the validation triggers. To provide selective validation, Microsoft has introduced a new collection property named as Unvalidated in the HTTPRequest class. This contains all the data that is passed from client to server like cookies, form collection, querystring etc as.

Image 4

Now the same data is available at two places. In UnValidated collection and normal in HTTPRequest. When we set the ValidateRequestMode is disabled, the data is accessed from UnValidated collection else normal request. UnValidated collection don't trigger any validation while other one triggers. I'll show you a demo later.

In earlier version of ASP.NET 1.1/2.0/3.5, Request validation is done at earlier level of page processing. There were also some good amount of changes took place in ASP.NET 4.0, which provides us the feature to validate the non-ASP.NET resources as well which was not available earlier.

What is going on behind the scene

I have the same application and I have removed the requestValidationMode attribute from web.config and putting some html tags as I did above example and pressed submit. So I got the HttpRequestValidationException as

Image 5

Now let's put the requestValidationMode as 4.5 and try the same as above. I have removed the disable attribute. Again I got the same exception as below

Image 6

But if we examine the circled part of the stacktrace, we can easily Identify that in 4.5, the validation exception got thrown from TextBox's LoadPostData method.

Let's do some experiment to examine this. I have made two case studies for this.

Case Study 1:

As we all know the ASP.NET Page LifeCycle as

Image 7

As you can see, here LoadPostData is a part of PageLife Cycle and comes after LoadViewState. All of the Input control's data dont get wiped off during postback even if viewstate is not enabled for that control. I have written a post on it. You can view this here.

So this is the LoadPostData method that is responsible to get the data from Form collection and assign it to the control. As I said, Now 4.5, validates the input only when you access the data from form collection. That's why if you look the stacktrace then it is visible that the exception is thrown from LoadPostData method only and page life cycle is the last stage of ASP.NET Request Processing.

Now lets try to have an clarification using a demo. As I mentioned, in ASP.NET 4.5, the validation triggers only when the data is accessed and the data is accessed at LoadPostData for input controls. So lets create a custom textbox. For this I'll override LoadPostData method and will do nothing in that. It means that the data would not be accessed for the customTextBox at LoadPostData. So even if the ValidationMode is enabled for the CustomtextBox, it wont be fired. Lets see this.

I have created a CustomtestBox and overridden the LoadPostData method as

public class CustomTextBox : System.Web.UI.WebControls.TextBox
        protected override bool LoadPostData(string postDataKey, NameValueCollection postCollection)
            return false;

You can see, I have just returned false in the LoadPostData method. Now I have used my CustomTextBox at my aspx page as

Image 8

Now set the requestValidationMode as 4.5 in web.config and enter some script tag and submit.

You would not get any error even RequestValidation is enabled. This proves the validation fires only when data is accessed from the form collection.

Case Study 2

Here I'll also try to prove the same as above. I have already shown above that How the new UnValidated property of Context holds all the data including form collection, querystring, cookies etc. So whenever the data is accessed from the UnValidated collection, the validation is not fired. But when it is accessed from the normal form collection, validation gets fired. So here I am going to use again the earlier sample. In that example I had two textboxes and a submit button. Here the change is that at server side, instead of accessing the data form txtValidate.Text, I'll be accessing the data from FormCollection. So I'll set the the ValidateRequestMode as disabled for both the textbox and will try to get the data one will be form normal Form Collection and another is from Unvalidated's form collection as

protected void Button1_Click(object sender, EventArgs e)
       string textValidated = this.Context.Request.Unvalidated.Form[txtValidate.UniqueID];
       string textUnValidated = this.Context.Request.Form[txtunValidate.UniqueID];
Now lets enter some html tags in both the textboxes and submit the page using debugger as Image 9

Oh!! see even we have disabled the validation, even in that situation when data is accessed from normal Form collection the validation is fired.

This again proves the validation is fired only when the data is acessed and when the ValidateRequestMode is set as disabled it is accessed from the UnValidated property.

Hope you all have enjoyed the post. Do share your precious feedback.


This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)


About the Author

Software Developer (Senior)
India India
Brij is a 3-times Microsoft MVP in ASP.NET/IIS Category and a passionate .NET developer. More than 6 years of experience in IT field, currently serving a MNC as a Tech Lead/Architect.

He is a very passionate .NET developer and have expertise over Web technologies like ASP.NET 2.0/3.5/4.0, jQuery, JSON, Javascript, IIS and related technologies. He is also a Exchange Server (EWS) Specialist. He has great experience in design patterns and N-Tier Architecture.

He is also certified as Microsoft Certified Technologies Specialist-ASP.NET and Microsoft Certified Technologies Specialist-WCF in .NET 4.0. He has also received several awards at various forums and his various articles got listed as "Article of the day" at ASP.NET Microsoft Official Website

He has done MCA from NIT Durgapur and completed his graduation from Lucknow University.

Learning new technologies and sharing knowledge excites him most. Blogging, solving problems at various forums, helping people, keeps him busy entire day.

Visit his Blog: Code Wala

Area of Expertise :
C#, ASP.NET 2.0,3.5,4.0, AJAX, JQuery, JSON, XML, XSLT, ADO.Net, WCF, Active Directory, Exchange Server 2007 (EWS), Java script, Web Services ,Win services, DotnetNuke, WSS 3.0,Sharepoint Designer, SQL Server 2000/2005/2008

Comments and Discussions

QuestionSome questions in the last example Pin
Member 1313499718-Apr-17 0:02
MemberMember 1313499718-Apr-17 0:02 
QuestionjQuery dialog doesn't work with requestValidationMode="4.5" Pin
jsneeringer4-Dec-16 5:13
Memberjsneeringer4-Dec-16 5:13 
AnswerSOLUTION: jQuery dialog doesn't work with requestValidationMode="4.5" Pin
jsneeringer4-Dec-16 10:05
Memberjsneeringer4-Dec-16 10:05 
Questionvalidation not deferred Pin
bort999925-Aug-15 1:02
Memberbort999925-Aug-15 1:02 
QuestionNo Solution sln file Pin
Member 8881-Feb-15 23:22
MemberMember 8881-Feb-15 23:22 
QuestionSource code in VB.NET Pin
Member 8881-Feb-15 23:21
MemberMember 8881-Feb-15 23:21 
GeneralMy vote of 5 Pin
Carsten V2.014-Nov-13 22:55
MemberCarsten V2.014-Nov-13 22:55 
Questionhttprequestvalidation Pin
robertkjr3d14-Nov-12 13:11
Memberrobertkjr3d14-Nov-12 13:11 
GeneralMy vote of 5 Pin
Abdul Sami, PMP22-Oct-12 9:24
MemberAbdul Sami, PMP22-Oct-12 9:24 
GeneralRe: My vote of 5 Pin
Brij22-Oct-12 9:28
mentorBrij22-Oct-12 9:28 
QuestionRe: My vote of 5 Pin
Abdul Sami, PMP22-Oct-12 9:35
MemberAbdul Sami, PMP22-Oct-12 9:35 
AnswerRe: My vote of 5 Pin
Brij31-Oct-12 0:18
mentorBrij31-Oct-12 0:18 
QuestionReg. Server Variables Pin
After205021-Aug-12 8:27
MemberAfter205021-Aug-12 8:27 
AnswerRe: Reg. Server Variables Pin
Brij23-Aug-12 7:32
mentorBrij23-Aug-12 7:32 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.