Overloading security check on dropdown, is it possible??

[Søren M. Olesen]

Hi

I'm trying to populate a dropdown list on a page, with the result from an
AJAX request, however, because my dropdown is runat="server" I get a
security error when posting back my page.
I guess that makes sence since a hacker could attemt to compromise the
webserver this way, however in my situation it's a bit of a problem.....

Is there a way to make the security check my self, so that I can determine
whether the data is OK or not??

TIA

Søren

 

[Dominick Baier [DevelopMentor]]

Hi,

i guess you are getting an ArgumentException?

you can disable that check by setting EnableEventValidation=false on the
page - but then - you have to thoroughly verify every single postback.

 

[Søren M. Olesen]

Yeah, I know I can disable the EnableEventValidation, but the I'd have to
check everything myself, I'd prefer to only check the stuff I know could be
changed from JScript....

Regards,

Søren

 

[Dominick Baier [DevelopMentor]]

I don't think that's gonna work - i haven't tried that though...

but EventValidation is also in code -

check the calls to

ClientScriptManager.RegisterForEventValidate and ValidateEvent.



---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

Create a Custom Control that inherits DropDownList and leave off the
[SupportsEventValidation]
attribute from the class.
Use that control rather than DropDownList and you will effectively
disable event validation for a single control on your page. Everything
else will function as normal.

Yeah, I know I can disable the EnableEventValidation, but the I'd
have to check everything myself, I'd prefer to only check the stuff I
know could be changed from JScript....

Regards,

Søren

 

[Stephen Davies]

Create a Custom Control that inherits DropDownList and leave off the
[SupportsEventValidation]
attribute from the class.

Use that control rather than DropDownList and you will effectively disable
event validation for a single control on your page. Everything else will
function as normal.