Welcome to the DNN Community Forums, your preferred source of online community support for all things related to DNN.
In order to participate you must be a registered DNNizen

HomeHomeUsing DNN Platf...Using DNN Platf...Administration ...Administration ...security problem with <pages validateRequest="true" in web.configsecurity problem with <pages validateRequest="true" in web.config
Previous
 
Next
New Post
5/30/2013 5:21 AM
 
When I set <pages validateRequest="true" in web.config , I can't update content in admin mode and in modules. What is the normal solution for that?

If I set validateRequest="false" it is  a security problem, so... 

 
New Post
5/31/2013 6:16 PM
 
IF you set validateRequest to true, then you essentially downgrading your site to a readonly site. Let me explain: if you allow HTML editing to happen on your site (which is an important feature of DotNetNuke), then RequestValidation will actually prevent you from doing so. Many security scanners that have no deep knowledge of the platform they are scanning will flag this as a security issue. Which is true to a point. Allowing someone to log on to your site, and edit content, is a security issue in itself. DotNetNuke has its own methods to make sure that content is validated and properly filtered where necessary. The setting validateRequest="false" is not supported

Erik van Ballegoij, Former DNN Corp. Employee and DNN Expert

DNN Blog | Twitter: @erikvb | LinkedIn: Erik van Ballegoij on LinkedIn

 
New Post
6/2/2013 2:07 AM
 

Hi, thanks for the answer.

Still I'm vulnerable to XSS attacks on some pages when  <pages validateRequest="false" is set to false, based on McAfee tests (I use Server.Encode where appropriate..)

 
New Post
6/3/2013 5:41 PM
 
the macafee tests are generic and do not understand the application. You are safe, it is a false positive.

If you are still uncertain, please send a mail to [email protected] for a more in depth explanation from our security team

Erik van Ballegoij, Former DNN Corp. Employee and DNN Expert

DNN Blog | Twitter: @erikvb | LinkedIn: Erik van Ballegoij on LinkedIn

 
New Post
8/29/2016 12:32 PM
 
More explanation:

HTTP request validation in ASP.NET is used to make sure that the user entered/selected values of the page controls sent to with the page callbacks are valid values that are not tampered with according to the validation rules set in the code behind and in the ASP.NET itself. For example, when you have a drop-down list control with 3 values, say “Low, Medium, and High”, and the post back sets the value for this control to some other value, say “Critical” that is not in the original list, then the validation check will fail this post back. This was made mainly during the old days when the controls were [always] static. But in today’s dynamic nature of web applications, there are lots of controls that are changed (or even added) dynamically though JavaScript (using jQuery or any other framework). When these control are manipulated this way, the ASP.NET back-end validation will fail most of the times and this will render the application unusable. Hence, we must disable ASP.NET built-in validation (partially) and rely on other methods to offset this. DNN sites use Anti-Forgery Token to prevent XSS for AJAX posts and post-back requests which will keep the site secure from XSS attacks even while setting
 
Previous
 
Next
HomeHomeUsing DNN Platf...Using DNN Platf...Administration ...Administration ...security problem with <pages validateRequest="true" in web.configsecurity problem with <pages validateRequest="true" in web.config


These Forums are dedicated to discussion of DNN Platform and Evoq Solutions.

For the benefit of the community and to protect the integrity of the ecosystem, please observe the following posting guidelines:

  1. No Advertising. This includes promotion of commercial and non-commercial products or services which are not directly related to DNN.
  2. No vendor trolling / poaching. If someone posts about a vendor issue, allow the vendor or other customers to respond. Any post that looks like trolling / poaching will be removed.
  3. Discussion or promotion of DNN Platform product releases under a different brand name are strictly prohibited.
  4. No Flaming or Trolling.
  5. No Profanity, Racism, or Prejudice.
  6. Site Moderators have the final word on approving / removing a thread or post or comment.
  7. English language posting only, please.

Content Layout

Subscribe to DNN Digest

Subscribe to DNN Digest

DNN Digest is our monthly email newsletter. It highlights news and content from around the DNN ecosystem, such as new modules and themes, messages from leadership, blog posts and notable tweets. Keep your finger on the pulse of the ecosystem by subscribing.  


Copyright 2017 by DNN Corp Terms of Use Privacy
What is Liquid Content?
Find Out
What is Liquid Content?
Find Out
What is Liquid Content?
Find Out