Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am currently testing a ASP.NET web application for its security. Doing so I came across the event validation mechanism.

Is there some way to bypass it? How much assurance is there that it cannot be bypassed?

share|improve this question
3  
what does "completely safe" mean? I'm very uncomfortable with the term. –  Mark C. Wallace Oct 31 '12 at 14:05
    
By "completely safe" I mean that there is NO way to send any form (e.g. select) values to the server that have not come from the server. (without any additional checks on the server) –  Dominik G Oct 31 '12 at 14:08
1  
Hi Dominik - I'd be in the same camp as Mark here - in information security "completely safe" doesn't really exist. ASP.NET event validation has a level of security, and you can configure your system to improve security, but you need to be aware that the "best" solution will still have vulnerabilities - the important thing is are those remaining vulnerabilities significant to you...? –  Rory Alsop Oct 31 '12 at 16:05
    
The absolute safest thing to do would be to check the incoming data before operating with it. If the user is only allowed to select 1 - 10 from the dropdown, then your application logic should enforce this restriction before consuming the data. –  Levi Nov 1 '12 at 3:52
    
Actually what I wanted to know is, how I can test if there are more checks. –  Dominik G Nov 1 '12 at 14:12

1 Answer 1

up vote 5 down vote accepted

ASP.NET Event validation does provide a decent level of protection against some specific web security attacks, but shouldn't be considered a panacea.

There have been vulnerabilities in the implementation in the past like the ASP.NET Null Bypass and also there are cases where it may not come into play (examples here and more recently here).

From that last link there's an interesting quote from Microsoft here "The ASP.NET request validation feature performs basic input validation. Do not rely on it. Use it as an extra precautionary measure in addition to your own input validation. Only you can define what represents good input for your application."

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.