Re: ClientScriptManager.RegisterForEventValidation

Thanks Scott, I'll check out the information.

Our vision is to develop an environment that will stimulate the transformation of data and information into knowledge and wisdom.  Our mission is to stay focused on the plans and goals with a sense of urgency necessary to improve the company's profitability and market share.
Shawn Hevel, API, AIT
Lead Programmer Analyst
Information Technology Department
South Carolina Farm Bureau Insurance Companies
Phone: (803) 936-4331
Fax: (803) 936-4629
Work Email: [email protected]
Home Email: [email protected]


-----Original Message-----
From: Scott Allen [mailto:[email protected]] 
Sent: Monday, July 16, 2007 11:40 AM
To: [email protected]
Subject: Re: [DOTNET-WEB] ClientScriptManager.RegisterForEventValidation

Shawn:

This exception is generally seen when you manipulate the post back values of
server side controls using client script (for instance - adding options to a
DropDownList with JavaScript). ASP.NET is trying to prevent <form> spoofing
and injection attacks. I have a couple posts detailing a scenario and
possible solutions [1] [2]. The best solution is to try and register all
your possible post back values for event validation.

You can also run into this error in high latency situations, too,
unfortunately. The hidden field with the event validation values goes out
the wire near the end of the page [3].

[1] http://OdeToCode.com/Blogs/scott/archive/2006/03/20/3145.aspx
[2] http://OdeToCode.com/Blogs/scott/archive/2006/03/21/3153.aspx
[3] http://OdeToCode.com/Blogs/scott/archive/2007/04/13/10696.aspx


--s

> -----Original Message-----
> From: Discussion of building .NET applications targeted for the Web
> [mailto:[email protected]] On Behalf Of Hevel, Shawn
> Sent: Monday, July 16, 2007 11:13 AM
> To: [email protected]
> Subject: [DOTNET-WEB] ClientScriptManager.RegisterForEventValidation
>
> I'm getting the following:
>
>
> Invalid postback or callback argument.  Event validation is enabled
> using <pages enableEventValidation="true"/> in configuration or <%@
> Page
> EnableEventValidation="true" %> in a page.  For security purposes, this
> feature verifies that arguments to postback or callback events
> originate
> from the server control that originally rendered them.  If the data is
> valid and expected, use the
> ClientScriptManager.RegisterForEventValidation method in order to
> register the postback or callback data for validation.
>
>
> Description: An unhandled exception occurred during the execution of
> the
> current web request. Please review the stack trace for more information
> about the error and where it originated in the code.
>
> Exception Details: System.ArgumentException: Invalid postback or
> callback argument.  Event validation is enabled using <pages
> enableEventValidation="true"/> in configuration or <%@ Page
> EnableEventValidation="true" %> in a page.  For security purposes, this
> feature verifies that arguments to postback or callback events
> originate
> from the server control that originally rendered them.  If the data is
> valid and expected, use the
> ClientScriptManager.RegisterForEventValidation method in order to
> register the postback or callback data for validation.
>
>
>
>
>
> I have found one work around that is to set the following statement in
> the web.config file:  <pages enableEventValidation="false"/>.
>
> I would rather not do that.  I'm having a hard time figuring out how to
> correct this situation.
>
> Any help here???
>
> Thanks,
>
> Our vision is to develop an environment that will stimulate the
> transformation of data and information into knowledge and wisdom.  Our
> mission is to stay focused on the plans and goals with a sense of
> urgency necessary to improve the company's profitability and market
> share.
>
> Shawn Hevel, API, AIT
> Lead Programmer Analyst
> Information Technology Department
> South Carolina Farm Bureau Insurance Companies
> Phone: (803) 936-4331
> Fax: (803) 936-4629
> Work Email: [email protected]
> Home Email: [email protected]
>
>
>
> ===================================
> This list is hosted by DevelopMentor.  http://www.develop.com
>
> View archives and manage your subscription(s) at
> http://discuss.develop.com

===================================
This list is hosted by DevelopMentor®  http://www.develop.com

View archives and manage your subscription(s) at http://discuss.develop.com

===================================
This list is hosted by DevelopMentor®  http://www.develop.com

View archives and manage your subscription(s) at http://discuss.develop.com