Professional ASP.NET 3.5 Security, Membership, and Role Management with C# and VB

9.1. Request Validation and Viewstate Protection

Two well-known protection mechanisms for ASP.NET pages are request validation and viewstate protection. Request validation has always been a bit of a mystery to developers, so in this section you will see exactly how it works in ASP.NET 2.0 and ASP.NET 3.5. Viewstate protections have been around since ASP.NET 1.0, but there have been some features added for viewstate protection in ASP.NET 2.0, which are now also part of ASP.NET 3.5.

9.1.1. Request Validation

Request validation is meant to detect strings posted to a web server that may contain suspicious character sequences. In general, request validation attempts to detect string information, which if subsequently rendered on a page, could result in a successful cross-site scripting attack. Request validation is not a general-purpose input validation mechanism. Constraining input to a valid set of values and preventing data from containing SQL injection attacks are still tasks the developer must implement.

By default, request validation is turned on. You can change the request validation settings with either the validateRequest attribute of the <pages /> element or the ValidateRequest attribute of the @Page directive. In general, you should keep request validation turned on, and turn it off on selected pages where you are encountering problems. The request validation feature checks the following Request collections for suspicious strings:

• Form variables

• Query string variables

• The ...