Symptoms

While processing an RSTR (Request for Security Token Response), System.Web throws the following exception:

System.Web.HttpRequestValidationException: A potentially dangerous Request.Form value was detected from the client (wresult="<t:RequestSecurityTo...").

   at System.Web.HttpRequest.ValidateString(String s, String valueName, String collectionName)

   at System.Web.HttpRequest.ValidateNameValueCollection(NameValueCollection nvc, String collectionName)

   at System.Web.HttpRequest.get_Form()

   at System.Web.HttpRequest.get_HasForm()

   at System.Web.UI.Page.GetCollectionBasedOnMethod(Boolean dontReturnNull)

   at System.Web.UI.Page.DeterminePostBackMode()

   at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)

   at System.Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)

   at System.Web.UI.Page.ProcessRequest()

   at System.Web.UI.Page.ProcessRequest(HttpContext context)

   at ASP.default_aspx.ProcessRequest(HttpContext context)

   at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()

Description: Request Validation has detected a potentially dangerous client input value, and processing of the request has been aborted. This value may indicate an attempt to compromise the security of your application, such as a cross-site scripting attack. To allow pages to override application request validation settings, set the requestValidationMode attribute in the httpRuntime configuration section to requestValidationMode="2.0". Example: <httpRuntime requestValidationMode="2.0" />. After setting this value, you can then disable request validation by setting validateRequest="false" in the Page directive or in the <pages> configuration section. However, it is strongly recommended that your application explicitly check all inputs in this case.

Cause

The web service was invoked where a parameter included an XML tag:

(wresult="<t:RequestSecurityTo...").

Resolution

You can turn off request validation, or you could create a class to handle validation.

Turning off validation:

Add the following to your web.config:

<pages validateRequest="false" />

If you are using ASP.NET 4, you will also need the following in the web.config:

<httpRuntime requestValidationMode="2.0" />

Creating a class to handle validation:

WIF SDK 4.0 provides you with a sample validator you can use for solving the error without giving up the validation. In fact, FedUtil.exe does everything for you if you launch it on a web site (but not for other project types). If you need to do it by hand, you can just add the class:

//-----------------------------------------------------------------------------

//

// THIS CODE AND INFORMATION IS PROVIDED 'AS IS' WITHOUT WARRANTY OF

// ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO

// THE IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A

// PARTICULAR PURPOSE.

//

// Copyright (c) Microsoft Corporation. All rights reserved.

//

//

//-----------------------------------------------------------------------------

using System;

using System.Web;

using System.Web.Util;

using Microsoft.IdentityModel.Protocols.WSFederation;

/// <summary>

/// This SampleRequestValidator validates the wresult parameter of the

/// WS-Federation passive protocol by checking for a SignInResponse message

/// in the form post. The SignInResponse message contents are verified later by

/// the WSFederationPassiveAuthenticationModule or the WIF signin controls.

/// </summary>

public class SampleRequestValidator : RequestValidator

{

    protected override bool IsValidRequestString( HttpContext context, string value, RequestValidationSource requestValidationSource, string collectionKey, out int validationFailureIndex )

    {

        validationFailureIndex = 0;

        if ( requestValidationSource == RequestValidationSource.Form && !String.IsNullOrEmpty( collectionKey ) && collectionKey.Equals( WSFederationConstants.Parameters.Result, StringComparison.Ordinal ) )

        {
            var unvalidatedFormValues = System.Web.Helpers.Validation.Unvalidated(context.Request).Form;

            SignInResponseMessage message = WSFederationMessage.CreateFromNameValueCollection( WSFederationMessage.GetBaseUrl( context.Request.Url ), unvalidatedFormValues ) as SignInResponseMessage;

            if ( message != null )

            {

                return true;

            }

        }

        return base.IsValidRequestString( context, value, requestValidationSource, collectionKey, out validationFailureIndex );

    }

}

And add the following line in the web.config:

 <httpRuntime requestValidationType="SampleRequestValidator" />

More Information

<httpRuntime requestValidationMode="2.0" />