RequestValidationSource Enumeration

.NET Framework (current version)
 

Specifies what kind of HTTP request data to validate.

Namespace:   System.Web.Util
Assembly:  System.Web (in System.Web.dll)

C#
C++
F#
VB
Copy 
public enum class RequestValidationSource

Member nameDescription
Cookies

The request cookies.

Files

The uploaded file.

Form

The form values.

Headers

The request headers.

Path

The virtual path.

PathInfo

An HTTP PathInfo string, which is an extension to a URL path.

QueryString

The query string.

RawUrl

The raw URL. (The part of a URL after the domain.)

You can create a custom request validation type by implementing the RequestValidator type. When ASP.NET calls the IsValidRequestString method to validate a request, ASP.NET passes a requestValidationSource parameter to specify the source of the data being validated. The RequestValidationSource enumeration is used to specify the source or kind of request data that is being validated. The enumeration indicates the type of HTTP input that is passed in the value parameter of the IsValidRequestString method. You can use the enumeration as a way to fall back to the base request validation implementation for HTTP inputs if you do not want to validate using custom logic.

The following example shows how to create a custom request validator class that allows only a specific string for query-string values.

[Visual Basic]

Copy 
Imports System
Imports System.Web
Imports System.Web.Util

Public Class CustomRequestValidation
    Inherits RequestValidator

Public Sub New()
End Sub

Protected Overloads Overrides Function IsValidRequestString( _
        ByVal context As HttpContext, _
        ByVal value As String, _
        ByVal requestValidationSource__1 As RequestValidationSource, _
        ByVal collectionKey As String, _
        ByRef validationFailureIndex As Integer) As Boolean
    validationFailureIndex = -1
    ' Set a default value for the out parameter.
    ' This application does not use RawUrl directly, so you can 
    ' ignore the check for RequestValidationSource.RawUrl.
    If requestValidationSource = RequestValidationSource.RawUrl Then
        Return True
    End If

    ' Allow the query-string key "data" to have an XML-like value.
    If (requestValidationSource = _
            (RequestValidationSource.QueryString) AndAlso _
            (collectionKey = "data") Then
        ' The querystring value "<example>1234</example>" is allowed.
        If value = "<example>1234</example>" Then
            validationFailureIndex = -1
            Return True
        Else
            ' Leave any further checks to ASP.NET.
            Return MyBase.IsValidRequestString(context, value, _
                requestValidationSource__1, collectionKey, _
                validationFailureIndex)
        End If
    Else
        ' All other HTTP input checks fall back to 
        ' the base ASP.NET implementation.
        Return MyBase.IsValidRequestString(context, value, _
            requestValidationSource__1, collectionKey, _
            validationFailureIndex)
    End If
End Function
End Class

[C#]

Copy 
using System;
using System.Web;
using System.Web.Util;

public class CustomRequestValidation : RequestValidator
{
    public CustomRequestValidation() {}

    protected override bool IsValidRequestString(
        HttpContext context, string value, 
        RequestValidationSource requestValidationSource, string collectionKey, 
        out int validationFailureIndex)
    {
        //Set a default value for the out parameter.
        validationFailureIndex = -1;

        // This application does not use RawUrl directly, 
        // so you can ignore the check for RequestValidationSource.RawUrl.
        if (requestValidationSource == RequestValidationSource.RawUrl)
            return true;

        // Allow the query-string key "data" to have an XML-like value.
        if (
            (requestValidationSource == RequestValidationSource.QueryString) &&
            (collectionKey == "data")
           )
        {
            // The querystring value "<example>1234</example>" is allowed.
            if (value == "<example>1234</example>")
            {
                validationFailureIndex = -1;
                return true;
            }
            else
           // Leave any further checks to ASP.NET.
                return base.IsValidRequestString(context, value, 
                requestValidationSource, collectionKey, out 
                validationFailureIndex);
        }
        // All other HTTP input checks fall back to 
        // the base ASP.NET implementation.
        else
        {
            return base.IsValidRequestString(context, value, 
                requestValidationSource, collectionKey, 
                out validationFailureIndex);
        }
    }
}

The following example shows how to configure ASP.NET to use the custom validator.

Copy 
<httpRuntime requestValidationType="CustomRequestValidation" />

.NET Framework
Available since 4.0
Return to top
Show: