Question

I have a page that contains a user control, when the user clicks an image button to take them to another page that displays details of the table row item they clicked an error occurs:

System.ArgumentException: Invalid postback or callback argument

I can stop this error from occurring if I set EnableEventValidation=”false”. Is this a security risk? If so, why?

Answer 1

This feature reduces the risk of unauthorized or malicious postback requests and callbacks. It is strongly recommended that you do not disable event validation.

When the EnableEventValidation property is set to true, ASP.NET validates that a control event originated from the user interface that was rendered by that control […]

see http://msdn.microsoft.com/en-us/library/system.web.ui.page.enableeventvalidation.aspx

I’d say if you keep the target page performing a single purpose – namely displaying detailed data – and make sure that the target page does not implement any potential security holes you can disable the EventValidation for THIS page. not in the web.config for the whole site!

But I think it’s better to investigate why you are getting this error! Maybe it’s a simple solution for you to redirect using Queryparameters, not form parameters to specify the data you want to display…