Is it possible to disable request validation for HttpHandlers?
A bit of background – I’ve got an ASP.NET web application using an HttpHandler to receive the payment response from WorldPay. The IIS logs show that the handler is being called correctly from WorldPay, but the code inside the handler is never called.
If I create a physical ASPX page and set ValidateRequest=false in the header, and put the same code in the Page_Load method, the code is called without any problems.
This solves the problem, though I’d prefer to stick with using an HttpHandler for this as it’s better suited for this type of functionality, rather than having an empty ASPX page, though this is dependent on being able to disable request validation.
The web application is using ASP.NET 2.0 and the server is IIS6.
Answers:
Thank you for visiting the Q&A section on Magenaut. Please note that all the answers may not help you solve the issue immediately. So please treat them as advisements. If you found the post helpful (or not), leave a comment & I’ll get back to you as soon as possible.
Method 1
it is quite easy. Change the following snippet to match the handler path and add in your web.config:
<configuration>
....
<location path="YOUR HANDLER PATH" allowOverride="true">
<system.web>
<httpRuntime requestValidationMode="2.0" />
<pages validateRequest="false" />
</system.web>
</location>
</configuration>
Method 2
For IIS7 we’ve been adding/modifying the following key in web.config
see http://www.asp.net/learn/whitepapers/aspnet4/breaking-changes#0.1__Toc256770147
Method 3
On IIS6 you can simply add validate="false" in the web.config registration.
<add path="handler.axd" type="Foo.Bar.MyHandler" verb="*" validate="false" />
If anyone could shed some light on how to accomplish this in IIS7’s integrated mode, it would be extremely helpful too.
All methods was sourced from stackoverflow.com or stackexchange.com, is licensed under cc by-sa 2.5, cc by-sa 3.0 and cc by-sa 4.0