How to switch/override the variable 'aspxerrorpath'?

Question

I am getting the problem of aspxerrorpath.

I dont want asp.net to validate this variable, even when I have custom page error enabled. If I write something like alert(7);'">https://...../asd.aspx?

aspxerrorpath=<script>alert(7);</script>' it throws an error and forward me to the aspx error page by default and not to one of my pre-defined custom error pages. Why? How can I override the aspxerrorpath behaviour?

Answer 1

You can add validateRequest="false" to the page that is handling the error (the one referenced in <customErrors mode="RemoteOnly" defaultRedirect="Error.aspx">)