enableEventValidation

[Guest]

I have a couple of pages that are throwing the following error:

HTTPUnhandledException and the text of the message is:

Invalid postback or callback argument. Event validation is enabled using
<pages enableEventValidation="true"/> in configuration or <%@ Page
EnableEventValidation="true" %> in a page. For security purposes, this
feature verifies that arguments to postback or callback events originate from
the server control that originally rendered them. If the data is valid and
expected, use the ClientScriptManager.RegisterForEventValidation method in
order to register the postback or callback data for validation.

I don't know what this means but I have tried putting enableEventValidation
in the web.config file and it crashes. I tried putting it in the page itself
in the <%@ Page directive and the page crashes. I tried seeing if it is part
of the Page object itself and it's not listed.

So what does this error mean and how do I get rid of it?

This site is a .Net 1.1 site in VB.Net.

TIA - Jeff.

 

[Muhammad Naveed Yaseen]

Your code probably contains a control from which your server-side code
got an event reference via ClientScript's GetCallbackEventReference,
GetPostBackClientHyperlink, GetPostBackEventReference or similar.

Afterwards that control was made invisible but the event referenced
was passed to some client side javascript which used that event
reference for call back.
ASP.NET detects from checksum that event did not originate from the
original control which owned it.

To solve the problem you may try following.
- Do not make control invisible by Visible="false". If required, do
that by not giving it text or content(i.e. Text=""). Or by setting
it's or some it's container's html style to "display:none"
- If its an ascx, you would also include following call in render
override.

protected override void Render(HtmlTextWriter writer)
{

Page.ClientScript.RegisterForEventValidation("ClientIDofClientSideControl"); //
this is VS 2005, in VS 2003 you directly use ClientScriptManager
base.Render(writer);
}

 

[jpasp]

enableEventValidation is a .NET 2.0 feature only. You can disable it
by setting value to false, either inside web.config or inside the aspx-
page (default is true), but you should not use enableEventValidation
at all if you're running .NET 1.1.
enableEventValidation is used to protect your forms from automated
spam robot abuse.