Invalid postback or callback argument

Question

This question seems to have been asked before, but I feel like my situation is slightly different.

I have a page that contains a gridview. When a button is pressed to edit one of the records in the gridview, the button first executes some client script that pops up a modal window for the purposes of editing (set using .onClientClick). From this pop-up, the user hits Update which updates the database and closes the window. Once the window is closed, the button's server-side code is supposed to fire, which will call the function to refresh the gridview. Instead, I get the error message:

Invalid postback or callback argument. Event validation is enabled using in configuration or in a page. For security purposes, this feature verifies that arguments to postback or callback events originate from the server control that originally rendered them. If the data is valid and expected, use the ClientScriptManager.RegisterForEventValidation method in order to register the postback or callback data for validation.

What really irks me is that I use this exact same logic on a different page and it works fine.

Any suggestions as to how I could avoid this?

UPDATE: I have removed the line of code that added the client-side script, and I still get the error. So I'm fairly positive it is being caused simply by the postback. Upon closer inspection I realize that there are in fact some ListItems being programatically bound to DropDownLists. So... I probably need to do the ClientScriptManager.RegisterForEventValidation thing.... Could someone possibly give me an example on what the syntax for doing that would look like? Seems to be set up differently than the ScriptManager object....

Answer 1

If your button is created in the code-behind (for example, your RowDataBound event creates a new instance of Button and adds it to a cell) then you will need to recreate those controls (with the same IDs) before the Control Events stage of the page life-cycle. Recreating the buttons in the Load event should work fine.

If your controls are created and you've attached handlers to their events then the most probable cause of this error is javascript which modifies your DOM/form.

Answer 2

This can be a tricky one to debug. If you're not using dynamically generated controls, the biggest culprit is generally client side scripts modifying the data that the controls are bound to. For example, adding another list item to a dropdownlist using javascript will trigger this error, as the server will notice that the added item was not part of the original data.

If you are using dynamic controls, you will have to ensure that the controls and their data are created the same way on every postback.

Whenever I run into irreconcilable event validation problems, I usually disable it on the page. This is supposedly a security issue, but I have yet to see an exploit relying on event validation being turned off. Actually, maybe I'll ask that on SO, to see if anyone knows of any. It's easy to sanitize your page inputs, and should be done without even thinking about whether event validation will protect you or not.

Answer 3

Hi Pal:

Try this line in the page directive, once I had a similar error and with this the error was solved

EnableEventValidation="false"

Regards!!!

Answer 4

Event validation will try to ensure someone isn't adding values to the page that doesn't correspond to what is allowed when you processed/rendered it for the first time. Depending on the controls you have, if you are doing a full rebind of the gridview, and the underlying data changed, this can make the "valid values" on the page to not match those received in the post back.

An option, that depends on the scenario, is to not use a postback in that case but do a regular link to get the page refreshed. Alternatively you can do EnableEventValidation=false as has been suggested, but you need to make extra sure you are not relying in any values you sent to the client i.e. dropdowns can come with values not in the list you bound.