I am currently testing a ASP.NET web application for its security. Doing so I came across the event validation mechanism.
Is there some way to bypass it? How much assurance is there that it cannot be bypassed?
4
-
3what does "completely safe" mean? I'm very uncomfortable with the term. – Mark C. Wallace Oct 31 '12 at 14:05
-
By "completely safe" I mean that there is NO way to send any form (e.g. select) values to the server that have not come from the server. (without any additional checks on the server) – Dominik G Oct 31 '12 at 14:08
-
1Hi Dominik - I'd be in the same camp as Mark here - in information security "completely safe" doesn't really exist. ASP.NET event validation has a level of security, and you can configure your system to improve security, but you need to be aware that the "best" solution will still have vulnerabilities - the important thing is are those remaining vulnerabilities significant to you...? – Rory Alsop♦ Oct 31 '12 at 16:05
-
The absolute safest thing to do would be to check the incoming data before operating with it. If the user is only allowed to select 1 - 10 from the dropdown, then your application logic should enforce this restriction before consuming the data. – Levi Nov 1 '12 at 3:52
-
Actually what I wanted to know is, how I can test if there are more checks. – Dominik G Nov 1 '12 at 14:12
5
ASP.NET Event validation does provide a decent level of protection against some specific web security attacks, but shouldn't be considered a panacea.
There have been vulnerabilities in the implementation in the past like the ASP.NET Null Bypass and also there are cases where it may not come into play (examples here and more recently here).
From that last link there's an interesting quote from Microsoft here "The ASP.NET request validation feature performs basic input validation. Do not rely on it. Use it as an extra precautionary measure in addition to your own input validation. Only you can define what represents good input for your application."
answered Oct 31 '12 at 18:40
