ValidateRequest=”false” doesn’t work in Asp.Net 4

I have a form at which I use ckeditor. This form worked fine at Asp.Net 2.0 and 3.5 but now it doesn’t work in Asp.Net 4+. I have ValidateRequest=”false” directive. Any suggestions?


Thank you for visiting the Q&A section on Magenaut. Please note that all the answers may not help you solve the issue immediately. So please treat them as advisements. If you found the post helpful (or not), leave a comment & I’ll get back to you as soon as possible.

Method 1

Found solution on the error page itself. Just needed to add requestValidationMode=”2.0″ in web.config

    <compilation debug="true" targetFramework="4.0" />
    <httpRuntime requestValidationMode="2.0" />

MSDN information: HttpRuntimeSection.RequestValidationMode Property

Method 2

There is a way to turn the validation back to 2.0 for one page. Just add the below code to your web.config:

    <location path="XX/YY">
            <httpRuntime requestValidationMode="2.0" />

    the rest of your configuration


Method 3

I know this is an old question, but if you encounter this problem in MVC 3 then you can decorate your ActionMethod with [ValidateInput(false)] and just switch off request validation for a single ActionMethod, which is handy. And you don’t need to make any changes to the web.config file, so you can still use the .NET 4 request validation everywhere else.


public ActionMethod Edit(int id, string value)
    // Do your own checking of value since it could contain XSS stuff!
    return View();

Method 4

This works without changing the validation mode.

You have to use a System.Web.Helpers.Validation.Unvalidated helper from System.Web.WebPages.dll. It is going to return a UnvalidatedRequestValues object which allows to access the form and QueryString without validation.

For example,

var queryValue = Server.UrlDecode(Request.Unvalidated("MyQueryKey"));

Works for me for MVC3 and .NET 4.

Method 5

Note that another approach is to keep with the 4.0 validation behaviour, but to define your own class that derives from RequestValidator and set:

<httpRuntime requestValidationType="YourNamespace.YourValidator" />

(where YourNamespace.YourValidator is well, you should be able to guess…)

This way you keep the advantages of 4.0s behaviour (specifically, that the validation happens earlier in the processing), while also allowing the requests you need to let through, through.

All methods was sourced from or, is licensed under cc by-sa 2.5, cc by-sa 3.0 and cc by-sa 4.0

0 0 votes
Article Rating
Notify of

Inline Feedbacks
View all comments
Would love your thoughts, please comment.x