Home/ Questions/Q 642747
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-13T21:12:25+00:00

I’ve got a DropDownList and I’m trying to prevent it from being used as

  • 0

I’ve got a DropDownList and I’m trying to prevent it from being used as an attack vector. Can I assume that the user is unable to actually change the values of the DDL and postback to the server? At the moment, I get this ASP.NET error message thrown if I try and change the packet after submission:

For security purposes, this feature verifies that arguments to postback or callback events originate from the server control that originally rendered them.

Am I right in thinking that this is due to the integrity being compromised in the viewstate hash? Can this be bypassed?

Thanks

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Actually you should be able to assume that the dropdown list options have not been changed client side as long as the page has EnableEventValidation = true (which is default although you can disable it per page or in the web.config). If a new value is added to your dropdownlist client side, and a postback occurs an error will occur unless you register this new value for event validation (http://odetocode.com/blogs/scott/archive/2006/03/21/asp-net-event-validation-and-invalid-callback-or-postback-argument-again.aspx)

    • 0