当前位置：文江博客话题详情

为什么我收到“从客户端检测到潜在危险的 Request.Form 值”？错误？

发布于 2024-11-05 10:45:51 字数 2983 浏览 3 评论 0 原文

我使用“Internet 应用程序”模板创建了一个新的 ASP.NET MVC 3 / .NET Framework 4.0 站点。我使用 Nuget 安装 Windows Azure Web Role (MVC3) 包并然后按照访问控制服务演练设置 Windows Live ID 和 Google 身份验证。

很快，我遇到了“从客户端检测到潜在危险的 Request.Form 值”错误，并按照 Windows Identity Foundation wiki 中的文章尝试解决该问题。不幸的是，我尝试过的任何方法都不起作用，包括：

Setting 和在根 web.config 和 Views\web.config
中
将 SampleRequestValidator 从 WIF SDK 复制到项目中并设置 < web.configs 中的 httpRuntime requestValidationType="SampleRequestValidator"/>

我也尝试过这些变体但没有成功。

有什么想法吗？

这是完整的异常：

异常详细信息： System.Web.HttpRequestValidationException：从客户端检测到潜在危险的 Request.Form 值 (wresult=" ")。

描述：请求验证检测到潜在危险的客户端输入值，请求处理已中止。该值可能表明有人试图破坏应用程序的安全性，例如跨站点脚本攻击。要允许页面覆盖应用程序请求验证设置，请将 httpRuntime 配置部分中的 requestValidationMode 属性设置为 requestValidationMode="2.0"。示例：。设置此值后，您可以通过在 Page 指令或配置部分中设置 validateRequest="false" 来禁用请求验证。但是，强烈建议您的应用程序在这种情况下显式检查所有输入。有关详细信息，请参阅 http://go.microsoft.com/fwlink/?LinkId=153133< /a>.

堆栈跟踪：

[HttpRequestValidationException (0x80004005)：从客户端检测到潜在危险的 Request.Form 值 (wresult="")。 ]

System.Web.HttpRequest.ValidateString(String value, String collectionKey, RequestValidationSource requestCollection) +8755668
System.Web.HttpRequest.ValidateNameValueCollection(NameValueCollection nvc, RequestValidationSource requestCollection) +122
System.Web.HttpRequest.get_Form() +114
Microsoft.IdentityModel.Web.WSFederationAuthenticationModule.IsSignInResponse(HttpRequest request) +75
Microsoft.IdentityModel.Web.WSFederationAuthenticationModule.CanReadSignInResponse(HttpRequest request, Boolean onPage) +205
Microsoft.IdentityModel.Web.WSFederationAuthenticationModule.CanReadSignInResponse(HttpRequest request) +41
Microsoft.IdentityModel.Web.WSFederationAuthenticationModule.OnAuthenticateRequest(Object sender, EventArgs args) +117
System.Web.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +148
System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +75

原文

I've created a new ASP.NET MVC 3 / .NET Framework 4.0 site using the "Internet Application" template. I used Nuget to install the Windows Azure Web Role (MVC3) package and then followed the Access Control Service walkthrough to set up Windows Live ID and Google authentication.

Soon enough, I came across the "A potentially dangerous Request.Form value was detected from the client" error and followed the article in the Windows Identity Foundation wiki to try and resolve it. Unfortunately nothing I've tried works, including:

Setting <httpRuntime requestValidationMode="2.0"/> and <pages validateRequest="false"> in both the root web.config and Views\web.config
Copying SampleRequestValidator from the WIF SDK into the project and setting <httpRuntime requestValidationType="SampleRequestValidator"/> in both web.configs

I've also tried variations of these without success.

Any ideas?

Here's the complete exception:

Exception Details: System.Web.HttpRequestValidationException: A potentially dangerous Request.Form value was detected from the client (wresult="<t:RequestSecurityTo...").

Description: Request Validation has detected a potentially dangerous client input value, and processing of the request has been aborted. This value may indicate an attempt to compromise the security of your application, such as a cross-site scripting attack. To allow pages to override application request validation settings, set the requestValidationMode attribute in the httpRuntime configuration section to requestValidationMode="2.0". Example: <httpRuntime requestValidationMode="2.0" />. After setting this value, you can then disable request validation by setting validateRequest="false" in the Page directive or in the <pages> configuration section. However, it is strongly recommended that your application explicitly check all inputs in this case. For more information, see http://go.microsoft.com/fwlink/?LinkId=153133.

Stack Trace:

[HttpRequestValidationException (0x80004005): A potentially dangerous Request.Form value was detected from the client (wresult="<t:RequestSecurityTo...").]

System.Web.HttpRequest.ValidateString(String value, String collectionKey, RequestValidationSource requestCollection) +8755668
System.Web.HttpRequest.ValidateNameValueCollection(NameValueCollection nvc, RequestValidationSource requestCollection) +122
System.Web.HttpRequest.get_Form() +114
Microsoft.IdentityModel.Web.WSFederationAuthenticationModule.IsSignInResponse(HttpRequest request) +75
Microsoft.IdentityModel.Web.WSFederationAuthenticationModule.CanReadSignInResponse(HttpRequest request, Boolean onPage) +205
Microsoft.IdentityModel.Web.WSFederationAuthenticationModule.CanReadSignInResponse(HttpRequest request) +41
Microsoft.IdentityModel.Web.WSFederationAuthenticationModule.OnAuthenticateRequest(Object sender, EventArgs args) +117
System.Web.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +148
System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +75

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

忆伤 2024-11-12 10:45:51

您可以尝试使用 [ValidateInput(false)] 属性（通过将保留在 <代码> web.config ）。

回复收藏 0 原文

红墙和绿瓦 2024-11-12 10:45:51

我也有同样的问题。

这是我的解决方案的一个示例：

 [ValidateInput(false)]

    public ActionResult *YourMethodName*(FormCollection forms)
    {
          // Encoded String
          string EncodedValue = Server.HtmlEncode(forms[*name or index*]);

         // Normal String 
         string value = forms[*name or index*]

         //.... 
    }

您的 webconfig 中不需要任何内容。

I had the same problem.

Here is an example of my solution:

 [ValidateInput(false)]

    public ActionResult *YourMethodName*(FormCollection forms)
    {
          // Encoded String
          string EncodedValue = Server.HtmlEncode(forms[*name or index*]);

         // Normal String 
         string value = forms[*name or index*]

         //.... 
    }

You don't need anything in your webconfig.

回复收藏 0 原文

眼中杀气 2024-11-12 10:45:51

我在这里写了一篇小博客注释：http:// /erikbra.wordpress.com/2012/04/17/wif-saml-token-post-and-requestvalidationmode2-0/。无需关闭请求验证，或为整个站点将其设置为 2.0。

简而言之，您只需将 WIF 回发 SAML 令牌的特定 URL 上的 requestValidationMode 更改为 2.0 模式。这可以通过 web.config 中的元素（有关详细信息，请参阅位置元素（ASP.NET 设置架构））来完成，如下所示：

<location path="WIFHandler">
  <system.web>
    <httpRuntime requestValidationMode="2.0" />
  </system.web>
</location>

应用程序中不需要存在“WIFHandler”位置，因为 WIF 将缩短管道在 ASP.NET 尝试处理请求之前，将您重定向到返回 URL（SAML 令牌 POST 的 wctx 参数中的 ru）。

在 web.config 文件的 WIF 配置部分中，确保将“reply”参数与将请求验证模式设置为 2.0 模式的位置相匹配：

<microsoft.identityModel>
    <service>
      <federatedAuthentication>
        <wsFederation passiveRedirectEnabled="true" 
                      issuer="https://localhost/STS/" 
                      realm="https://localhost/MyApp/"
                      reply="https://localhost/MyApp/WIFHandler/" />

(...)

I wrote a small blog note on this here: http://erikbra.wordpress.com/2012/04/17/wif-saml-token-post-and-requestvalidationmode2-0/. It isn't necessary to turn off request validation, or set it to 2.0 for your entire site.

In short, you only need to alter the requestValidationMode to 2.0 mode on the specific URL that WIF posts back the SAML token to. This can be done with a element (see location Element (ASP.NET Settings Schema) for details) in your web.config, like this:

<location path="WIFHandler">
  <system.web>
    <httpRuntime requestValidationMode="2.0" />
  </system.web>
</location>

The “WIFHandler” location does not need to exist in your app, as WIF will shortcut the pipeline before ASP.NET tries to handle the request, and redirect you to the return url (ru in the wctx parameter of the SAML token POST) instead.

In your WIF configuration section of the web.config file, be sure to match the “reply” parameter with the location where you set request validation mode to 2.0 mode:

<microsoft.identityModel>
    <service>
      <federatedAuthentication>
        <wsFederation passiveRedirectEnabled="true" 
                      issuer="https://localhost/STS/" 
                      realm="https://localhost/MyApp/"
                      reply="https://localhost/MyApp/WIFHandler/" />

(...)

回复收藏 0 原文

生生漫 2024-11-12 10:45:51

首先 - 缩小它的来源。使用 fiddler 调查哪个字段导致了问题。像这样简单的项目：

回复收藏 0 原文

对风讲故事 2024-11-12 10:45:51

将 SampleRequestValidator 从 WIF SDK 复制到项目中并在两个 web.configs 中进行设置

这应该可以修复它。您能验证代码实际上正在执行吗？如果您在请求验证器中放置断点，它会命中吗？

我假设您将放在下，对吗？

回复收藏 0 原文

难理解 2024-11-12 10:45:51

我在这里没有看到任何答案提到这一点。就这样吧。

除了“[ValidateInput(false)]”之外，在您的 aspx 中，您可能还需要将其添加到您的 <%@Page ...> 中。

<%@ Page ValidateRequest="false">

这将允许在每个页面而不是整个 Web 应用程序上禁用请求验证。

I don't see any answer here mention this. so here it goes.

In addition to the " [ValidateInput(false)]", in your aspx, you might need to add this to your <%@Page ...>

<%@ Page ValidateRequest="false">

This would allow disabling request validation on a per page basis instead of the whole web app.

回复收藏 0 原文

や三分注定 2024-11-12 10:45:51

我在学习“从 Active Directory 到 Windows Azure 应用程序的单点登录”教程时遇到了这个问题。就我而言，问题是我无意中将值放置在错误的部分中我的 web.config 文件（我最初没有注意到这一点，但有一个新的部分，其路径为“FederationMetadata”，也包含 system.web。）。该值应放置在顶级部分中。