Why was the request for ASP.NET MVC checked?

Question

In standard ASP.net applications, ASP.net offered some protection against XSS attacks by checking for validateRequest to detect dangerous input errors if someone tried. It seems that this functionality was derived from MVC of any idea?

Answer 1

This is a difficult line to cross. Is your web application just a RESTful web resource as it should be? Or is he trying to do more. The next thing you know, you have 100 hidden input fields: __VIEWSTATE, __EVENTTARGET, __EVENTARGUMENT, etc. Etc.

, XSS MVC. google it, . , MVC - , " " -.

EDIT: , , . , MVC , ( ASP.NET). .

Answer 2

, , , .

ValidateInput, .

[ValidateInput(true)]
public ActionResult Foo()
{

}

AllowHtml

public class MyModel
{
    public Guid ID { get; set; }

    [AllowHtml]
    public string SomeStringValue { get; set; }
}

Answer 3

, - , ValidateRequest, XSS. .

Answer 4

ValidateRequest . , " XSS" - -; .

I really like the explanation regarding the desire to better follow the principles of REST. As for the 100 hidden fields, this reminds me of the ASP solution I provided several years ago; I used the distribution of hidden fields to transfer metadata. Not really.