Why was validate request taken out of ASP.net MVC?

Question

In standard ASP.net applications ASP.net offered some protection from XSS attacks with validateRequest throwing detect dangerous input errors if some one tried to. This functionality seems to have been taken out of MVC any idea why?

Thanks,

Alex

Answer 1

This is a hard line to cross. Is your web application just a RESTful web resource like it 'should' be? Or is it trying to do more. Next thing you know you have 100 hidden input fields: __VIEWSTATE, __EVENTTARGET, __EVENTARGUMENT, etc, etc.

As you know, you can still prevent XSS attacks in MVC. Just google it to see several examples. But the reason is basically that MVC is a different, 'cleaner' type of web application.

EDIT: I don't know if what I've said above is clear. But the idea is that MVC isn't going to try to be more than what it is (like ASP.NET does). They both have their strong points and reasons.

Answer 2

I hope you have something more robust than ValidateRequest to avoid XSS, anyway.

Answer 3

I find the ValidateRequest solution as a hack. In my opinion 'warding off XSS' is a Business Rule; therefore let the Model handle the situation.

I really like the explanation regarding the desire to better follow REST principles. As to the 100 hidden fields, it reminds me of an ASP solution I provided some years ago; I used a proliferation of hidden fields to carry metadata. Not pretty.

Answer 4

I know this question is old but I thought I could answer it anyway.

There is a ValidateInput action filter attribute which can be added to actions.

[ValidateInput(true)]
public ActionResult Foo()
{

}