Handle validation failures myself in ASP.NET MVC

Question

We all know that familiar ASP.NET error page that we see many times during development. To keep a consistent feel to my site, I'd rather the user not see those errors, and handle them myself. For most everything, I can catch the exception and return my own error page, and we're all happy.

Except for one area, request validation. This is an annoying point for me, because the exception is thrown before the request ever reaches the controller, so I'm able to catch and handle it it myself.

I can add "[ValidateInput(false)]" to my method to force invalid requests through, but obviously this is disabling necessary validation checking. It was recommend to me that I use "ModelState.IsValid" in conjunction to manually invoke the input validation, but IsValid seems to be simply always returning 'false' which is no help.

How can I force the standard input validation to take place IN my controller action, and not before?

danludwig · Accepted Answer · 2012-04-02 20:38:41Z

Request validation is not the same as model validation. Request validation (which you can disable using [ValidateInput(false)]) tries to protect potentially dangerous user input from ever reaching your controller / action method. This is why the exception is thrown from the request pipeline before the input ever reaches your controller.

I don't think you can change this pipeline behavior without forking the MVC WebRuntime source code and using your own personal branch of the MVC library. You shouldn't do that.

However, you can probably handle the error and redirect to a custom error page by using Application_Error in your global.asax.

var ex = Server.GetLastError();
if (ex == null) return;
if (ex.GetType() == typeof(HttpException) && ex.Message.StartsWith(
    "A potentially dangerous Request.Path value was detected from the client"))
    // redirect to your custom error page here

Nick Bork · Accepted Answer · 2012-04-02 20:45:08Z

0

Create a single base controller. Add [ValidateInput(false)] to the controller class:

 [ValidateInput(false)]
 public class BaseController : Controller
 {

 }

And then update every controller to inherit from it:

 public class HomeController : BaseController
 {

 }

I don't suggest turning off Request Validation myself but if you must, you can.

answered Apr 2, 2012 at 20:45

Nick Bork

4,8411 gold badge26 silver badges25 bronze badges

2 Comments

danludwig Over a year ago

If you were going to turn it off for all controllers and all action methods, why not just add it as a global filter during Application_Start?

public static void RegisterGlobalFilters(GlobalFilterCollection filters)         {             filters.Add(new ValidateInputAttribute(false));         }

Nick Bork Over a year ago

You may not want it for every single controller. You can also turn off request validation in the web.config. asp.net/whitepapers/request-validation

Collectives™ on Stack Overflow

Handle validation failures myself in ASP.NET MVC

2 Answers 2

Comments

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related