A Potentially Dangerous Request.Form Value Was Detected From The Client

by

When you receive the error message “A potentially dangerous Request.Form value was detected from the client”, it means that the ASP.NET request validation has detected HTML or script tags in the form submission that could potentially be harmful.

ASP.NET has built-in protection against cross-site scripting (XSS) attacks by default, which means it blocks any form submissions that contain potentially dangerous content.

To demonstrate this, let’s consider a simple example:

<form method="post" action="process-form.asp">
  <input type="text" name="inputContent" value="<script>alert('Hello World!');</script>">
  <input type="submit" value="Submit">
</form>

In the above HTML form, we have a text input field with a default value containing a script tag. When this form is submitted to the server, ASP.NET will detect the potentially dangerous content and throw the “A potentially dangerous Request.Form value was detected” error.

To resolve this issue, you have a few options:

  • Disable request validation: This is not recommended as it leaves your application vulnerable to XSS attacks, but you can disable request validation for the specific page or form by adding the following line of code in the page directive:
<%@ Page ValidateRequest="false" %>
  • Use request validation exceptions: You can mark specific input fields as exempt from request validation by using the `[AllowHtml]` attribute in your model class. This approach is useful when you trust the input and want to allow HTML or script tags in specific fields.
public class MyModel
{
    public string SafeContent { get; set; }

    [AllowHtml]
    public string PotentiallyUnsafeContent { get; set; }
}
  • Encode and sanitize input: The recommended approach is to validate and sanitize user input before accepting it. You should encode any user-generated content to HTML entities or use libraries that automatically sanitize the input to prevent script injection. For example:
string sanitizedContent = HttpUtility.HtmlEncode(submittedContent);

By following these practices, you can prevent the “A potentially dangerous Request.Form value was detected from the client” error and ensure that your application remains secure against XSS attacks.

Same cateogry post

Leave a comment