Question

We have an exception that keeps cropping up in our Event Viewer logs for our server, caused by explicit attempts to hack our site by our PCI security company. It gets annoying as it crops up all the time, and initially it was generating the ‘yellow screen of death’ and logging in the event viewer as an unhandled exception. We put an exception handler around the code where he exception was coming from (inside Phalanger if you are interested), so it now longer crashes and causes the yellow screen of death, but it STILL ends up in the event viewer logs as a warning!

Any idea how to turn it off in the event viewer short of turning off request validation completely, which I was trying to avoid?

We are using ASP.NET MVC 3 so I know I can use the new ValidateInput attribute to do this, but I would rather leave it turned on but be able to handle the exceptions ourselves and not have them get logged to the event viewer even though I catch it and handle it?

Answer 1

Add following code to Global.asax.cs

    void Application_Error(object sender, EventArgs e)
    {
        Exception ex = Server.GetLastError();
        if (ex is HttpRequestValidationException)
        {
            Server.ClearError();
            Response.Clear();
            Response.StatusCode = 200;

            // add content below
            Response.Write("");
            Response.End();
        }
    }