This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "ASP.NET Request Validation"
(→Description) |
|||
| Line 4: | Line 4: | ||
''Request validation'' is a feature in ASP.NET that examines HTTP requests and determines whether they contain potentially dangerous content. This check adds protection from markup or code in the URL query string, cookies, or posted form values that might have been added for malicious purposes. This exploit is typically referred to as a ''cross-site scripting'' (XSS) attack. Request validation helps to prevent this kind of attack by throwing a "potentially dangerous value was detected" error and halting page processing if it detects input that may be malicious, such as markup or code in the request. | ''Request validation'' is a feature in ASP.NET that examines HTTP requests and determines whether they contain potentially dangerous content. This check adds protection from markup or code in the URL query string, cookies, or posted form values that might have been added for malicious purposes. This exploit is typically referred to as a ''cross-site scripting'' (XSS) attack. Request validation helps to prevent this kind of attack by throwing a "potentially dangerous value was detected" error and halting page processing if it detects input that may be malicious, such as markup or code in the request. | ||
| − | + | ==Don't Rely on Request Validation for XSS Protection== | |
| − | Request validation is generally desirable and should be left enabled for [[defense in depth]]. It should ''' | + | Request validation is generally desirable and should be left enabled for [[defense in depth]]. It should '''NOT''' be used as your sole method of XSS protection, and does not guarantee to catch every type of invalid input. There are known, documented bypasses (such as JSON requests) that will not be addressed in future releases, and the request validation feature is no longer supported in ASP.NET vNext. |
| − | = | + | Fully protecting your application from malicious input involves validating each field of user supplied data. For Web Forms based applications this will start with [http://msdn.microsoft.com/en-us/library/debza5t0(v=vs.100).aspx ASP.NET Validation Controls]. ASP.NET MVC and Web API based applications should decorate model classes with [http://msdn.microsoft.com/en-us/library/ee256141(VS.100).aspx DataAnnotations attributes]. Any string input that is stored, returned to the client, or interpreted should be encoded using an appropriate method, such as those from [[ASP.NET Output Encoding#Enhanced_Encoding|AntiXssEncoder]]. |
| − | |||
| − | <pre> | + | <pre>var encodedInput = Server.HtmlEncode(userInput);</pre> |
| − | You | + | ==Enabling Request Validation== |
| + | Request validation is enabled by default in ASP.NET. You can check to make sure it is not disabled by reviewing he following areas: | ||
| − | < | + | {| class="wikitable" |
| + | |ASP.NET Web Forms (Global) | ||
| + | |Ensure that request validation has not been disabled in web.config: <code><pages validateRequest="false" /></code> | ||
| + | |- | ||
| + | |ASP.NET Web Forms (Page Level) | ||
| + | |Check to make sure request validation is not disabled at the page level: <code><@ Page ValidateRequest="false" %></code> | ||
| + | |- | ||
| + | |ASP.NET 4.0+ | ||
| + | |Starting with ASP.NET 4.0 request validation is performed for all requests, not just for .aspx page requests. To ensure this is configured correctly look to see that it has '''NOT''' been set to 2.0: <code><httpRuntime requestValidationMode="2.0" /></code> | ||
| + | |} | ||
| − | + | ===ASP.NET 4.5+=== | |
| + | There are enhancements added to request validation starting with ASP.NET 4.5 that include deferred ("lazy") validation, the ability to opt-out at the server control level, and the ability to access unvalidated data. In order to leverage these enhancements you will need to ensure that <code>requestValidationMode</code> has been set to "4.5". | ||
| − | <pre><httpRuntime requestValidationMode=" | + | <pre><httpRuntime requestValidationMode="4.5" targetFramework="4.5" /></pre> |
===ASP.NET Web API=== | ===ASP.NET Web API=== | ||
ASP.NET Web API does not utilize the request validation feature to sanitize user input. You will need to add this protection manually if any input will be used in HTML output. For example if user input is returned to the browser as the result from an AJAX request to a Web API method. | ASP.NET Web API does not utilize the request validation feature to sanitize user input. You will need to add this protection manually if any input will be used in HTML output. For example if user input is returned to the browser as the result from an AJAX request to a Web API method. | ||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
==Selectively Disabling Request Validation== | ==Selectively Disabling Request Validation== | ||
| − | In some cases you may need to accept input that will fail ASP.NET Request Validation, such as when receiving HTML markup from the end user. In these scenarios you should disable request validation for the smallest surface possible | + | In some cases you may need to accept input that will fail ASP.NET Request Validation, such as when receiving HTML markup from the end user. In these scenarios you should disable request validation for the smallest surface possible and ensure you have implemented field level input validation. |
===ASP.NET Web Forms=== | ===ASP.NET Web Forms=== | ||
| − | For ASP.NET Web Forms applications you will need to disable request validation at the page level. Be aware that when doing this all input values (cookies, query string, form elements) handled by this page will not be validated by ASP.NET. | + | For ASP.NET Web Forms applications prior to v4.5, you will need to disable request validation at the page level. Be aware that when doing this all input values (cookies, query string, form elements) handled by this page will not be validated by ASP.NET. |
<pre><@ Page ValidateRequest="false" %></pre> | <pre><@ Page ValidateRequest="false" %></pre> | ||
| + | |||
| + | Starting with ASP.NET 4.5 you can disable request validation at the individual server control level by setting <code>ValidateRequestMode</code> to "Disabled". | ||
| + | <pre><asp:TextBox ID="txtASPNet" ValidateRequestMode="Disabled" runat="server" /></pre> | ||
===ASP.NET MVC=== | ===ASP.NET MVC=== | ||
| Line 65: | Line 62: | ||
==References== | ==References== | ||
*[http://msdn.microsoft.com/en-us/library/hh882339(v=vs.110).aspx Request Validation in ASP.NET] | *[http://msdn.microsoft.com/en-us/library/hh882339(v=vs.110).aspx Request Validation in ASP.NET] | ||
| − | *[http://msdn.microsoft.com/en-us/library/ | + | *[http://msdn.microsoft.com/en-us/library/debza5t0(v=vs.100).aspx Validation ASP.NET Controls] |
| + | *[http://msdn.microsoft.com/en-us/library/ee256141(VS.100).aspx How to: Validate Model Data Using DataAnnotations Attributes] | ||
| + | *[http://msdn.microsoft.com/en-us/library/system.web.security.antixss.antixssencoder(v=vs.110).aspx AntiXssEncoder Class] | ||
| + | *[http://www.asp.net/aspnet/overview/aspnet-and-visual-studio-2012/whats-new#_Toc318097379 New ASP.NET Request Validation Features] | ||
| + | *[http://msdn.microsoft.com/en-us/library/system.web.ui.control.validaterequestmode(v=vs.110).aspx Control.ValidateRequestMode Property] | ||
*[http://msdn.microsoft.com/en-us/library/system.web.mvc.validateinputattribute(v=vs.118).aspx ValidateInputAttribute Class] | *[http://msdn.microsoft.com/en-us/library/system.web.mvc.validateinputattribute(v=vs.118).aspx ValidateInputAttribute Class] | ||
*[http://msdn.microsoft.com/en-us/library/system.web.mvc.allowhtmlattribute(v=vs.118).aspx AllowHtmlAttribute Class] | *[http://msdn.microsoft.com/en-us/library/system.web.mvc.allowhtmlattribute(v=vs.118).aspx AllowHtmlAttribute Class] | ||
| − | |||
| − | |||
*[[ASP.NET Output Encoding]] | *[[ASP.NET Output Encoding]] | ||
[[Category:OWASP .NET Project]] | [[Category:OWASP .NET Project]] | ||
Revision as of 00:16, 3 November 2014
DRAFT DOCUMENT - WORK IN PROGRESS
Description
Request validation is a feature in ASP.NET that examines HTTP requests and determines whether they contain potentially dangerous content. This check adds protection from markup or code in the URL query string, cookies, or posted form values that might have been added for malicious purposes. This exploit is typically referred to as a cross-site scripting (XSS) attack. Request validation helps to prevent this kind of attack by throwing a "potentially dangerous value was detected" error and halting page processing if it detects input that may be malicious, such as markup or code in the request.
Don't Rely on Request Validation for XSS Protection
Request validation is generally desirable and should be left enabled for defense in depth. It should NOT be used as your sole method of XSS protection, and does not guarantee to catch every type of invalid input. There are known, documented bypasses (such as JSON requests) that will not be addressed in future releases, and the request validation feature is no longer supported in ASP.NET vNext.
Fully protecting your application from malicious input involves validating each field of user supplied data. For Web Forms based applications this will start with ASP.NET Validation Controls. ASP.NET MVC and Web API based applications should decorate model classes with DataAnnotations attributes. Any string input that is stored, returned to the client, or interpreted should be encoded using an appropriate method, such as those from AntiXssEncoder.
var encodedInput = Server.HtmlEncode(userInput);
Enabling Request Validation
Request validation is enabled by default in ASP.NET. You can check to make sure it is not disabled by reviewing he following areas:
| ASP.NET Web Forms (Global) | Ensure that request validation has not been disabled in web.config: <pages validateRequest="false" />
|
| ASP.NET Web Forms (Page Level) | Check to make sure request validation is not disabled at the page level: <@ Page ValidateRequest="false" %>
|
| ASP.NET 4.0+ | Starting with ASP.NET 4.0 request validation is performed for all requests, not just for .aspx page requests. To ensure this is configured correctly look to see that it has NOT been set to 2.0: <httpRuntime requestValidationMode="2.0" />
|
ASP.NET 4.5+
There are enhancements added to request validation starting with ASP.NET 4.5 that include deferred ("lazy") validation, the ability to opt-out at the server control level, and the ability to access unvalidated data. In order to leverage these enhancements you will need to ensure that requestValidationMode has been set to "4.5".
<httpRuntime requestValidationMode="4.5" targetFramework="4.5" />
ASP.NET Web API
ASP.NET Web API does not utilize the request validation feature to sanitize user input. You will need to add this protection manually if any input will be used in HTML output. For example if user input is returned to the browser as the result from an AJAX request to a Web API method.
Selectively Disabling Request Validation
In some cases you may need to accept input that will fail ASP.NET Request Validation, such as when receiving HTML markup from the end user. In these scenarios you should disable request validation for the smallest surface possible and ensure you have implemented field level input validation.
ASP.NET Web Forms
For ASP.NET Web Forms applications prior to v4.5, you will need to disable request validation at the page level. Be aware that when doing this all input values (cookies, query string, form elements) handled by this page will not be validated by ASP.NET.
<@ Page ValidateRequest="false" %>
Starting with ASP.NET 4.5 you can disable request validation at the individual server control level by setting ValidateRequestMode to "Disabled".
<asp:TextBox ID="txtASPNet" ValidateRequestMode="Disabled" runat="server" />
ASP.NET MVC
To disable request validation for a specific MVC controller action, you can use the [ValidateInput(false)] attribute as shown below.
[ValidateInput(false)] public ActionResult Update(int userId, string description)
Starting with ASP.NET MVC 3 you should use the [AllowHtml] attribute to decorate specific fields on your view model classes where request validation should not be applied:
public class User
{
public int Id { get; set; }
public string Name { get; set; }
public string Email { get; set; }
[AllowHtml]
public string Description { get; set; }
[AllowHtml]
public string Bio { get; set; }
}
