Invalid postback or callback argument.Event validation is enabled using

Question

Since moving to .net 4.5.1 from 2.0 I have this error

Invalid postback or callback argument. Event validation is enabled using in configuration or <%@ Page EnableEventValidation="true" %> in a page. For security purposes, this feature verifies that arguments to postback or callback events originate from the server control that originally rendered them. If the data is valid and expected, use the ClientScriptManager.RegisterForEventValidation method in order to register the postback or callback data for validation.

[ArgumentException: Invalid postback or callback argument. Event validation is enabled using in configuration or <%@ Page EnableEventValidation="true" %> in a page. For security purposes, this feature verifies that arguments to postback or callback events originate from the server control that originally rendered them. If the data is valid and expected, use the ClientScriptManager.RegisterForEventValidation method in order to register the postback or callback data for validation.]
System.Web.UI.ClientScriptManager.ValidateEvent(String uniqueId, String argument) +144
System.Web.UI.Control.ValidateEvent(String uniqueID, String eventArgument) +111
System.Web.UI.WebControls.DropDownList.LoadPostData(String postDataKey, NameValueCollection postCollection) +55
System.Web.UI.WebControls.DropDownList.System.Web.UI.IPostBackDataHandler.LoadPostData(String postDataKey, NameValueCollection postCollection) +16
System.Web.UI.Page.ProcessPostData(NameValueCollection postData, Boolean fBeforeLoad) +303
System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +1593

What I can do?

I have this problem on localhost, but if I try to acces it remote the problem is solved (on another workstation). If the workmate try to acces it on his pc ( the one that work for me) they encounter the same problem but if they use my workstation the app works.

Solution 1

I had the same problem. In my case the problem was caused because I was inserting javascript inside the form tag and that javascript was submitting the form. The code worked well for years until I moved my solution from .NET 3.5 to 4.5.1 . In an ASP.NET WebForm there are some hidden fields generated automatically. One of these fields is the __EVENTVALIDATION field, which acts as a safeguard against posting unauthorised data (like adding an extra option into a DropDownList server control from javascript).

<input type="hidden" name="__EVENTVALIDATION" id="__EVENTVALIDATION" value="/wEdAAN+KgYAJkWoXhOSD3+DUVvd3588JQsnNAC5MN7/uyI1ci6YmP63wnPMGlpCSu3QTgdg0MzSFI9etYOG29clJ48nEH4YX8U9SWslVBX+CGpmog==" />

Usually these hidden fields are generated as the first elements inside the form. However after upgrading this element started to appear as the last element inside the form, just underneath my javascript that was doing the submitting. Therefore this field was not sent as part of the request and the server was interpretting this as an attempt to post unauthorised data.

After a bit of research I found that there is a configuration inside the web.config that you can use to control the placement of the fields:

<system.web>
    <pages renderAllHiddenFieldsAtTopOfForm="true" />
</system.web>

However this is by default true so it had no effect. And after researching this configuration and finding a partial answer here Why is the renderAllHiddenFieldsAtTopOfForm configuration setting ignored? , I used Resharper + DotPeek + the code from http://http://referencesource.microsoft.com/ to debug inside System.Web assembly. I found that in debug mode the InnerWriter property was not HttpWriter, but type of Microsoft.VisualStudio.Web.PageInspector.Runtime.Tracing.BrowserLinkExecutionListener.PassthroughPositionTracker.PassthroughTextWriter. The PageInspector feature was interfering with the page rendering.

MY SOLUTION:

Disabling PageInspector (I did not need it at all), by inserting the following tag in the appsettings section inside the web.config :

<appSettings>
  <add key="PageInspector:ServerCodeMappingSupport" value="Disabled" />
</appSettings>

And this worked for me. More info here http://bchavez.bitarmory.com/archive/2012/12/28/rip-page-inspector-out-of-your-web-site-projects-now.aspx

Solution 2

The problem was that I was submitting the form before the whole page loaded and _EVENTVALIDATION was, for some reasons I don't understand, at the end of the form. I overridden the Render method and moved the _EVENTVALIDATION input at the top of the form. Now it works.

Comments

[mikus]

read about page.EnableEventValidation? google the error? ;)

[mikus]

Possible duplicate of Invalid postback or callback argument. Event validation is enabled using '<pages enableEventValidation="true"/>'

[Robert Sandu]

I have this problem on localhost, but if I try to acces it remote the problem is solved (on another workstation). If the workmate try to acces it on his pc ( the one that work for me) they encounter the same problem but if they use my workstation the app works.

[mikus]

have you tried solution mentioned in the comment above?

[Robert Sandu]

I can't disable event validation (is not a good idea). I can't use ASP.NET Ajax UpdatePanel or use classic postback (we have a in house framework).

[mikus]

there is still an option to use the RegisterForEventValidation, right? ;-)

[Robert Sandu]

Yes, I can use that. But is very strange that the application works fine on any workstation in the company except my own pc (the same is true for my colleagues). Another strange thing is that for one colleague the app works fine even on localhost. So I am trying to find an explanation for that before modifying the framework

[mikus]

are you sure it works? maybe it just doesnt show any exception, as it's defined to hide error details for remote machines?