Say a ASP.NET page, or any html page for that matter, has a drop down list with a bunch of prices. On posting the page, the code looks at the selection of the drop down list for a computation. Is it possible for someone to alter the values and post the page without the server knowing the page has been tampered with?
I have been told ASP.NET does offer some protection from this with Page.EnableEventValidation Property. With this enabled (enabled by default), trying to change the value of an ASP control will result in an error:
Invalid postback or callback argument. Event validation is enabled using in configuration or <%@ Page EnableEventValidation="true" %> in a page. For security purposes, this feature verifies that arguments to postback or callback events originate from the server control that originally rendered them. If the data is valid and expected, use the ClientScriptManager.RegisterForEventValidation method in order to register the postback or callback data for validation.