ValidateRequest=”false” doesn’t work in Asp.Net 4

The Question :

157 people think this question is useful

I have a form at which I use ckeditor. This form worked fine at Asp.Net 2.0 and 3.5 but now it doesn’t work in Asp.Net 4+. I have ValidateRequest=”false” directive. Any suggestions?

The Question Comments :
  • There’s short article about rendering validation controls properly if anyone cares: Error Validation in .NET 4
  • can anyone please let me know what are the drawbacks of using ValidationRequest=false?

The Answer 1

196 people think this answer is useful

Found solution on the error page itself. Just needed to add requestValidationMode=”2.0″ in web.config

    <compilation debug="true" targetFramework="4.0" />
    <httpRuntime requestValidationMode="2.0" />

MSDN information: HttpRuntimeSection.RequestValidationMode Property

The Answer 2

103 people think this answer is useful

There is a way to turn the validation back to 2.0 for one page. Just add the below code to your web.config:

    <location path="XX/YY">
            <httpRuntime requestValidationMode="2.0" />

    the rest of your configuration


The Answer 3

57 people think this answer is useful

I know this is an old question, but if you encounter this problem in MVC 3 then you can decorate your ActionMethod with [ValidateInput(false)] and just switch off request validation for a single ActionMethod, which is handy. And you don’t need to make any changes to the web.config file, so you can still use the .NET 4 request validation everywhere else.


public ActionMethod Edit(int id, string value)
    // Do your own checking of value since it could contain XSS stuff!
    return View();

The Answer 4

28 people think this answer is useful

This works without changing the validation mode.

You have to use a System.Web.Helpers.Validation.Unvalidated helper from System.Web.WebPages.dll. It is going to return a UnvalidatedRequestValues object which allows to access the form and QueryString without validation.

For example,

var queryValue = Server.UrlDecode(Request.Unvalidated("MyQueryKey"));

Works for me for MVC3 and .NET 4.

The Answer 5

15 people think this answer is useful

Note that another approach is to keep with the 4.0 validation behaviour, but to define your own class that derives from RequestValidator and set:

<httpRuntime requestValidationType="YourNamespace.YourValidator" />

(where YourNamespace.YourValidator is well, you should be able to guess…)

This way you keep the advantages of 4.0s behaviour (specifically, that the validation happens earlier in the processing), while also allowing the requests you need to let through, through.

Add a Comment