Funny Exception:Invalid postback or callback argument

[Chuck P]

I familiar with getting the below exception when someone puts a < in a textbox.

Invalid postback or callback argument. Event validation is enabled using
<pages enableEventValidation="true"/> in configuration or <%@ Page
EnableEventValidation="true" %> in a page. For security purposes, this
feature verifies that arguments to postback or callback events originate from
the server control that originally rendered them. If the data is valid and
expected, use the ClientScriptManager.RegisterForEventValidation method in
order to register the postback or callback data for validation.


However, I have a page with a readonly grid and no other controls.
The grid has a couple buttons that read an integer id for the row and then
do a Response.Redirect.


When I have an Unhandled exception, the application emails me with the
exception and the HTTP junk.

Out of a thousand hits to the same web page 2 Mac/Safari users resulted in
this message. Interestingly, after calling them, they said they got no
exception, everything was fine.

<Exception>
System.Web.HttpUnhandledException: Exception of type
'System.Web.HttpUnhandledException' was thrown. --->
System.ArgumentException: Invalid postback or callback argument. Event
validation is enabled using <pages enableEventValidation="true"/> in
configuration or <%@ Page EnableEventValidation="true" %> in a page. For
security purposes, this feature verifies that arguments to postback or
callback events originate from the server control that originally rendered
them. If the data is valid and expected, use the
ClientScriptManager.RegisterForEventValidation method in order to register
the postback or callback data for validation. at
System.Web.UI.ClientScriptManager.ValidateEvent(String uniqueId, String
argument) at System.Web.UI.WebControls.Button.RaisePostBackEvent(String
eventArgument) at System.Web.UI.Page.RaisePostBackEvent(IPostBackEventHandler
sourceControl, String eventArgument) at
System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint,
Boolean includeStagesAfterAsyncPoint) --- End of inner exception stack trace
--- at System.Web.UI.Page.HandleError(Exception e) at
System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint,
Boolean includeStagesAfterAsyncPoint) at
System.Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint,
Boolean includeStagesAfterAsyncPoint) at System.Web.UI.Page.ProcessRequest()
at System.Web.UI.Page.ProcessRequest(HttpContext context) at
ASP.default_aspx.ProcessRequest(HttpContext context) at
System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean&
completedSynchronously)
</Exception>

Any ideas?

 

[Steven Cheng]

Hi Chuck,

As for the "Invalid postback .... Eventvalidation...", it is a common
exception due to the ASP.NET 2.0's new feature on validate the postback
data. This validation is not longer targeting those markup or script code
in text field. But also verify whether the ASP.NET webform's server
control(which will postback data) have been tampered by some malicious
client-side code.

Scott has ever posted two good articles which clearly explain how the
eventValidation works:

#ASP.NET Event Validation and “Invalid Callback Or Postback Argument?: Part
I
http://odetocode.com/Blogs/scott/archive/2006/03/20/3145.aspx

#ASP.NET Event Validation and “Invalid Callback Or Postback Argument?: Part
II
http://odetocode.com/blogs/scott/archive/2006/03/21/3153.aspx

#Asp.net - Invalid postback or callback argument. Event validation is
enabled using ?pages enableEventValidation=”true?>’…
http://stackoverflow.com/questions/228969/aspnet-invalid-postback-or-callbac
k-argument-event-validation-is-enabled-using

For your issue, I think you can first check that problem page to see
whether it has adopted some javascript that will possibly inject some new
post data(html input fields or entries ) at client-side.

Sincerely,

Steven Cheng

Microsoft MSDN Online Support Lead


Delighting our customers is our #1 priority. We welcome your comments and
suggestions about how we can improve the support we provide to you. Please
feel free to let my manager know what you think of the level of service
provided. You can send feedback directly to my manager at:
(e-mail address removed).

==================================================
Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/en-us/subscriptions/aa948868.aspx#notifications.







--------------------

From: =?Utf-8?B?Q2h1Y2sgUA==?= <[email protected]>
Subject: Funny Exception:Invalid postback or callback argument
Date: Thu, 8 Jan 2009 09:10:02 -0800

I familiar with getting the below exception when someone puts a < in a textbox.

Invalid postback or callback argument. Event validation is enabled using
<pages enableEventValidation="true"/> in configuration or <%@ Page
EnableEventValidation="true" %> in a page. For security purposes, this
feature verifies that arguments to postback or callback events originate from
the server control that originally rendered them. If the data is valid and
expected, use the ClientScriptManager.RegisterForEventValidation method in
order to register the postback or callback data for validation.


However, I have a page with a readonly grid and no other controls.
The grid has a couple buttons that read an integer id for the row and then
do a Response.Redirect.


When I have an Unhandled exception, the application emails me with the
exception and the HTTP junk.

Out of a thousand hits to the same web page 2 Mac/Safari users resulted in
this message. Interestingly, after calling them, they said they got no
exception, everything was fine.

<Exception>
System.Web.HttpUnhandledException: Exception of type
'System.Web.HttpUnhandledException' was thrown. --->
System.ArgumentException: Invalid postback or callback argument. Event
validation is enabled using <pages enableEventValidation="true"/> in
configuration or <%@ Page EnableEventValidation="true" %> in a page. For
security purposes, this feature verifies that arguments to postback or
callback events originate from the server control that originally rendered
them. If the data is valid and expected, use the
ClientScriptManager.RegisterForEventValidation method in order to register
the postback or callback data for validation. at
System.Web.UI.ClientScriptManager.ValidateEvent(String uniqueId, String
argument) at System.Web.UI.WebControls.Button.RaisePostBackEvent(String
eventArgument) at

System.Web.UI.Page.RaisePostBackEvent(IPostBackEventHandler

sourceControl, String eventArgument) at
System.Web.UI.Page.ProcessRequestMain(Boolean

includeStagesBeforeAsyncPoint,

Boolean includeStagesAfterAsyncPoint) --- End of inner exception stack trace
--- at System.Web.UI.Page.HandleError(Exception e) at
System.Web.UI.Page.ProcessRequestMain(Boolean

includeStagesBeforeAsyncPoint,

Boolean includeStagesAfterAsyncPoint) at
System.Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint,
Boolean includeStagesAfterAsyncPoint) at

System.Web.UI.Page.ProcessRequest()

 

[Chuck P]

I was aware of that stuff. This page just has a grid with buttons. No ajax,
no javascript unless the grid uses javascript in readonly mode.

The issues I have are why only this happens a couple of times per thousand
hits?
Why does the user not get the exception page, they don't even see the
exception.

//UHE on threads
AppDomain.CurrentDomain.UnhandledException += new
UnhandledExceptionEventHandler(OnUhe);

application.Error += new EventHandler(OnError); //regular UHE

 

[Steven Cheng]

Thanks for your reply Chuck,

How did you get that those errors occured when the certain client users
access the webapplication? If the client user didn't see any error on the
browser UI, the error must be generated by some background http request.
for example, some ajax request or some web crawler like app client which
programmtically send http request to the web application. In such cases, it
is likely that the http request content may contain some invalid html
markup that result to such exception.

Sincerely,

Steven Cheng

Microsoft MSDN Online Support Lead


Delighting our customers is our #1 priority. We welcome your comments and
suggestions about how we can improve the support we provide to you. Please
feel free to let my manager know what you think of the level of service
provided. You can send feedback directly to my manager at:
(e-mail address removed).

--------------------

 

[Chuck P]

http://odetocode.com/Blogs/scott/archive/2007/04/13/10696.aspx

The above article discusses the same problem.
I don't think it is a network congestion problem though. We are on a real
fast intranet.
Also the problem only occurs periodically in Safari.

 

[Steven Cheng]

Hi Chuck,

If the problem only occurs for some safari browsers and the user cannot
even see the error screen. I suggest you use some trace tools such as
fiddler to see whether there is any browser add-on which send some http
request in background that raise such error.

Sincerely,

Steven Cheng

Microsoft MSDN Online Support Lead


Delighting our customers is our #1 priority. We welcome your comments and
suggestions about how we can improve the support we provide to you. Please
feel free to let my manager know what you think of the level of service
provided. You can send feedback directly to my manager at:
(e-mail address removed).


--------------------

References: <[email protected]>

<[email protected]>