从客户端检测到一个潜在危险的Request.Form值(wresult ="<trust:RequestSecuri ...")

Question

使用WIF时,我也收到了请求验证错误.我被正确地发送到STS,但在回来的路上,我得到了这个验证错误.

我遵循了所有指示.

<httpRuntime  requestValidationMode="2.0" />

校验!

    [ValidateInput(false)]

校验!

<pages validateRequest="false" >

校验!

我尝试了一个自定义验证器,但它永远不会被实例化.

错误堆栈:

[HttpRequestValidationException (0x80004005): A potentially dangerous Request.Form value was detected from the client (wresult="trust:RequestSecuri...").]
   System.Web.HttpRequest.ValidateString(String value, String collectionKey, RequestValidationSource requestCollection) +11396740
   System.Web.HttpRequest.ValidateNameValueCollection(NameValueCollection nvc, RequestValidationSource requestCollection) +82
   System.Web.HttpRequest.get_Form() +212
   Microsoft.IdentityModel.Web.WSFederationAuthenticationModule.IsSignInResponse(HttpRequest request) +26
   Microsoft.IdentityModel.Web.WSFederationAuthenticationModule.CanReadSignInResponse(HttpRequest request, Boolean onPage) +145
   Microsoft.IdentityModel.Web.WSFederationAuthenticationModule.OnAuthenticateRequest(Object sender, EventArgs args) +108
   System.Web.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +80
   System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +270

有什么建议？

Answer 1

<httpRuntime requestValidationMode="2.0"/>

在此之后添加

<configuration>
    <system.web>
        <pages validateRequest="false" />
    </system.web>
</configuration>

同样在mvc3中有一个AllowHtml属性

[AllowHtml]
public string Property{ get; set; }

这里有一些有用的链接

ASP.NET MVC - 页面validateRequest = false不起作用？

为什么ValidateInput(False)不起作用？