I am currently testing a ASP.NET web application for its security. Doing so I came across the event validation mechanism.
Is there some way to bypass it? How much assurance is there that it cannot be bypassed?
ASP.NET Event validation does provide a decent level of protection against some specific web security attacks, but shouldn't be considered a panacea.
From that last link there's an interesting quote from Microsoft here "The ASP.NET request validation feature performs basic input validation. Do not rely on it. Use it as an extra precautionary measure in addition to your own input validation. Only you can define what represents good input for your application."