How can Request Validation be disabled for HttpHandlers?

Question

Is it possible to disable request validation for HttpHandlers?

A bit of background - I've got an ASP.NET web application using an HttpHandler to receive the payment response from WorldPay. The IIS logs show that the handler is being called correctly from WorldPay, but the code inside the handler is never called.

If I create a physical ASPX page and set ValidateRequest=false in the header, and put the same code in the Page_Load method, the code is called without any problems.

This solves the problem, though I'd prefer to stick with using an HttpHandler for this as it's better suited for this type of functionality, rather than having an empty ASPX page, though this is dependent on being able to disable request validation.

The web application is using ASP.NET 2.0 and the server is IIS6.

Answer 1

On IIS6 you can simply add validate="false" in the web.config registration.

<add path="handler.axd" type="Foo.Bar.MyHandler" verb="*" validate="false" />

If anyone could shed some light on how to accomplish this in IIS7's integrated mode, it would be extremely helpful too.

Answer 2

For IIS7 we've been adding/modifying the following key in web.config

see http://www.asp.net/learn/whitepapers/aspnet4/breaking-changes#0.1__Toc256770147