Question

Regarding the decorator [AllowHtml] on a property or even the [ValidateInput(false)] on a method, what is the best way to catch the HttpRequestValidationException and append it to the ModelState to show as a friendly error on the user side and not show an error page (either throwing a new page under Application_Error or make the use of custom error pages.

Inside the global.asax I have a trap:

protected void Application_Error()
{
    // http://romsteady.blogspot.dk/2007/06/how-to-catch-httprequestvalidationexcep.html
    // Code that runs when an unhandled error occurs

    System.Exception ex = Server.GetLastError();

    if (ex is System.Web.HttpRequestValidationException)
    { 
        // I got the exception here, I can do plenty now!

        Server.ClearError(); // no need to continue, I know the error
    }
}

how do I get from here to the model state, without using any Session/Application variables (thinking about cloud here and all those different server hosting the user request)?

I was thinking add to the route, or TempData but such is not available here… maybe a Cookie but seams to hacky…

Any ideas?

Answer 1

Error handling in ASP.NET MVC is a controversial subject. You have different choices to handle errors. Read:

• How can I properly handle 404 in ASP.NET MVC?
• ASP.NET MVC HandleError