If I summed it all up, I must have spent more than a day struggling to disable request validation with asp.net mvc. It is just ridiculously hard to disable it.

It turns out that the only way to disable it once and for all is a combination of a setting in the web.config and the ValidateRequestAttribute.

  1. Add the following line to your web.config file right after : ****
  2. Add the [ValidateInput(false)] attribute to the controller and the action method you want to expose
  3. Rebuild the project and go drink a beer.

Remember it may be unsafe to disable request validation due to potential vulnerability XSS and XSRF attacks.

Note: This is targeted to ASP.NET 4, when the requestValidationMode attribute was introduced. In .NET 3.5, you can skip the first step and only do 2 and 3, but I’m not 100% positive about that.

Happy coding :)