Request Validation with ASP.Net MVC 5

Question

In the past, I've been accustomed to being able to use request validation as a first line of defense for XSS.

However, I don't seem to be able to get the validation to kick in.

<httpRuntime requestValidationMode="4.5"/>

<configuration>
    <system.web>
        <pages validateRequest="true" />
    </system.web>
</configuration>

Regardless of this configuration, errors are not thrown and validation is not being run. Is there some other global way to enable/disable validation that I am missing?

As in request validation is not triggering when a form is posted to the controller. — ddango
– ddango, Commented Nov 22, 2016 at 22:51
So in C# code, not javascript. Ok where is your model, can wee see it? — CodingYoshi
– CodingYoshi, Commented Nov 22, 2016 at 22:52
To confirm, you're not using any of the newfangled OWIN/Katana stuff, but "classic" IIS-hosted application? — Dai
– Dai, Commented Nov 22, 2016 at 22:55

Ryno Coetzee · Accepted Answer · 2018-04-25 08:13:16Z

1

There are enhancements added to request validation starting with ASP.NET 4.5 that include deferred ("lazy") validation, the ability to opt-out at the server control level, and the ability to access unvalidated data. In order to leverage these enhancements you will need to ensure that requestValidationMode has been set to "4.5"

web.config:

<configuration>
  <system.web>
    <httpRuntime requestValidationMode="4.5"/>
  </system.web>
</configuration>

from: https://www.owasp.org/index.php/ASP.NET_Request_Validation

answered Apr 25, 2018 at 8:13

Ryno Coetzee

5174 silver badges13 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Request Validation with ASP.Net MVC 5

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest