Handling HttpRequestValidationException in ASP.NET

Question

I have a problem where some users come to my site with cookies that contain < or & characters (partly outside my control). These are flagged Dangerous by ASP.NET. What I would like to do is to be able to catch the exception, check for certain well-known cases that I want to allow and then throw the exception again. I don't want to end up in the global Application_Error, because I want the request to carry on as if nothing happened in the selected "known cases".

I thought that I could do this by reading my Request.Cookies in the Application_BeginRequest and then catch the exeption. Turns out however that this is too early. The cookies can be read without any problem at this time. Inspection (reflector) learns that the validation exceptions are only thrown after the HttpRequest.ValidateInput() method is called. This sets the validation "sharp", but it's not clear to me when this happens. So when/where to trigger the validation to prevent it from bubbling up later? Or maybe some totally different approach?

Answer 1

You could disable this kind of validation by disabling request validation on the web.config

<configuration>  
    <system.web>  
       <pages validateRequest="false" />  
    </system.web>
</configuration>

Answer 2

I turns out to be quite difficult to handle this exception. I have not found a real answer to my question, but I found a work-around that may work for other too, so I'll document it here. The suspect values in my cookies are actually written there by Google Analytics,so I cannot prevent the values with < in it to be written. However, I do not really need these cookies on the server anyway. Google Analytics reads their content on the client. So what I did was checking the contents of the cookiesmyself and clearing any suspect content for the duration of the Request by setting the value to "". The cookies remains as is, but the content in the Request.Cookies collection is gone.

Good enough for me.

private static Regex _hasHtmlTag = new Regex("<\\w"); // matches an < with a letter or number after it
protected void Application_BeginRequest(object sender, EventArgs e)
{
    foreach (string name in Request.Cookies)
    {
        string cookieValue = Request.Cookies[name].Value;
        if (_hasHtmlTag.IsMatch(cookieValue))
        {
            // Leave the cookie alone, but remove from the request
            Request.Cookies[name].Value = "";
        }
    }
}