MVC request validation is off, still throws exception when accessing Request.Form

Question

By default ASP.net will do request validation to make sure values submitted by the user aren't potentially dangerous. See this popular queston regarding how to disable it.

I have disabled it successfully so that the controller doesn't throw an exception if potentially dangerous characters are detected. However, if I access the Request.Forms property, it attempts to do request validation again and will throw the exception. Specifically what I'm doing is this: request.Form.ToString() .

The controller has been decorated with [ValidateInput(false)] and the Model decorated with [AllowHtml()] neither of which are being honored while accessing the Request.Forms property. How can I do this without the exception being thrown?

Answer 1

.Net 4.0 adds additional request validation that you need to disable by adding requestValidationMode="2.0" to the httpRuntime element of your web.config.

See ASP.NET breaking changes for more info.