2

I am receiving this message from a site hosted publicly:

System.Web.HttpException: A potentially dangerous Request.Path value was detected from the client (&).

I have read articles about using:

<httpRuntime requestPathInvalidCharacters="" />

Not sure how to incorporate or resolve these type of potential dangerous requests. I may not be understanding something.

Thanks for any help understanding...

2

1 Answer 1

2

Try setting ValidateRequest="false" in the page directive. Depending on what version of ASP.NET you're using, you may also need to add the following web.config setting:

<httpRuntime requestValidationMode="2.0" />

Important Note

By disabling the default request validation, you should be prepared to detect and handle potentially malicious content manually in your logic.

10
  • I am using 4.0. Can you tell me what ValidateRequest and requestValidationMode does?
    – obautista
    Nov 9, 2011 at 18:14
  • Okay, then you'll probably need the web.config setting. Nov 9, 2011 at 18:14
  • 1
    ValidateRequest determines whether ASP.NET should examine the input from the browser for potentially dangerous values. For example, request validation would throw an exception if an input contained markup of any sort. Nov 9, 2011 at 18:17
  • So I do not want to allow potentially dangerous requests. So I do not want to turn off ValidateRequest in page directive, correct? I am trying to determine if I need to do anything special for this or if leaving the way I have it is okay (to not allow dangerous requests). I currently do not have requestValidationMode in my webconfig.
    – obautista
    Nov 9, 2011 at 19:26
  • 1
    @JamesJohnson: Just because you are seeing this error does not at all imply tat you should turn off request validation! Did you consider that those requests could be malicious? What is the web app supposed to do with them anyways if they are invalid?
    – Oliver
    Jun 27, 2012 at 17:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.