zoukankan      html  css  js  c++  java
  • A potentially dangerous Request.Form value was detected from the client

    A potentially dangerous Request.Form value was detected from the client

    针对这个问题,以前在.net Framework2.0里,只要修改

    <pages validateRequest="false" /> 
    就可以

    但是现在在4.0里,需要修改

    The request validation feature in ASP.NET provides a certain level of default protection against cross-site scripting (XSS) attacks. In previous versions of ASP.NET, request validation was enabled by default. However, it applied only to ASP.NET pages (.aspx files and their class files) and only when those pages were executing.

    In ASP.NET 4, by default, request validation is enabled for all requests, because it is enabled before the BeginRequest phase of an HTTP request. As a result, request validation applies to requests for all ASP.NET resources, not just .aspx page requests. This includes requests such as Web service calls and custom HTTP handlers. Request validation is also active when custom HTTP modules are reading the contents of an HTTP request.

    As a result, request validation errors might now occur for requests that previously did not trigger errors. To revert to the behavior of the ASP.NET 2.0 request validation feature, add the following setting in the Web.config file:

    <httpRuntime requestValidationMode="2.0" />

    However, we recommend that you analyze any request validation errors to determine whether existing handlers, modules, or other custom code accesses potentially unsafe HTTP inputs that could be XSS attack vectors.

    这样才对

  • 相关阅读:
    NOIP模拟测试2「排列 (搜索)·APIO划艇」
    Linux运维基础
    Linux之权限详解
    Linux之特殊符号与正则表达式
    Linux之命令进阶
    Linux分区的几种方案
    开启MySQL远程访问权限 允许远程连接
    Linux命令
    win10 激活(亲测可用)
    帮你解决无法早起的焦虑-顺便撸羊毛
  • 原文地址:https://www.cnblogs.com/sdytzz/p/2768823.html
Copyright © 2011-2022 走看看