User Input In Sheep’s Clothing

We all know that it is bad bad bad to trust user input. I don�t care if your users are all ascetic monks in a remote monastery, do not trust their input. However, user input often likes to put on sheep�s clothing and disguise itself as something else entirely, such as the case with ViewState . Another example of this is highlighted in the latest entry of his excellent series of ASP.NET MVC tips. In this post, Stephen Walther writes about how cookie values and server variables can be passed as parameters to action methods. Immediately, commenters understably asked whether this was safe or not. One person went so far as to call this a security hole in controller actions. However, to be extremely nitpicky, the security implication isn't in...(read more) ...