4

I am currently testing a ASP.NET web application for its security. Doing so I came across the event validation mechanism.

Is there some way to bypass it? How much assurance is there that it cannot be bypassed?

5
  • 3
    what does "completely safe" mean? I'm very uncomfortable with the term.
    – MCW
    Oct 31, 2012 at 14:05
  • By "completely safe" I mean that there is NO way to send any form (e.g. select) values to the server that have not come from the server. (without any additional checks on the server)
    – Dominik G
    Oct 31, 2012 at 14:08
  • 1
    Hi Dominik - I'd be in the same camp as Mark here - in information security "completely safe" doesn't really exist. ASP.NET event validation has a level of security, and you can configure your system to improve security, but you need to be aware that the "best" solution will still have vulnerabilities - the important thing is are those remaining vulnerabilities significant to you...?
    – Rory Alsop
    Oct 31, 2012 at 16:05
  • The absolute safest thing to do would be to check the incoming data before operating with it. If the user is only allowed to select 1 - 10 from the dropdown, then your application logic should enforce this restriction before consuming the data.
    – Levi
    Nov 1, 2012 at 3:52
  • Actually what I wanted to know is, how I can test if there are more checks.
    – Dominik G
    Nov 1, 2012 at 14:12

1 Answer 1

5

ASP.NET Event validation does provide a decent level of protection against some specific web security attacks, but shouldn't be considered a panacea.

There have been vulnerabilities in the implementation in the past like the ASP.NET Null Bypass and also there are cases where it may not come into play (examples here and more recently here).

From that last link there's an interesting quote from Microsoft here "The ASP.NET request validation feature performs basic input validation. Do not rely on it. Use it as an extra precautionary measure in addition to your own input validation. Only you can define what represents good input for your application."

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .