Question

We’re using ASP.NET MVC3 with Razor View engine and standard HTML and jquery on the client side. We’re trying to pass an “&” in the post url of a search request but we are always getting an A potentially dangerous Request.Path value was detected from the client (&), though we did encode it from the javascript side using encodeURIComponent

http://localhost:6200/en/us/home/GetPoints/cat-0,gov-0,city-0,key-casper%26gambibi,addr-!1!10

Thanks
Yehia

Answer 1

One approach could be to modify the requestPathInvalidCharacters attribute of the HttpRuntime node in the web.config

httpRuntime Element

By using the following HttpRuntime configuration setting you can keep validation tight by removing the & character validation check however leaving the others in place.

The defaults for “requestPathInvalidCharacters” are “<,>,*,%,&,:,\”.
So just remove the &.

<httpRuntime requestValidationMode="4.0" executionTimeout="20"
requestPathInvalidCharacters="&lt;,&gt;,*,%,:,\,?"  /> 

But as Chris mentions in his comment above, passing the search values in the query string will work without the above httpRuntime change:

http://localhost:6200/en/us/home/GetPoints?paramName=key-casper%26gambibi&......