<< YSlow performance challenge | BlogEngine.NET goes mainstream >>

Invalid postback or callback argument

by Mads Kristensen 9. August 2007 04:09

I’ve hooked a health provider up in my web.config to send me all unhandled exceptions by e-mail. See here how to do that – you just have to put some lines in the web.config. Well, I get all sorts of different exceptions but one I get more than 20 times a day. It’s actually rear that I get anything else than this one particular unhandled exception.

It looks like this:

Exception type: System.ArgumentException
Exception message: Invalid postback or callback argument. Event validation is enabled using <pages enableEventValidation="true"/> in configuration or <%@ Page EnableEventValidation="true" %> in a page. For security purposes, this feature verifies that arguments to postback or callback events originate from the server control that originally rendered them. If the data is valid and expected, use the ClientScriptManager.RegisterForEventValidation method in order to register the postback or callback data for validation.

Am I an idiot?

Now you might think that I’m an idiot that I didn’t do anything about it months ago, but hold on a minute. It says that a postback is invalid because event validation is turned on. It’s turned on by default in ASP.NET so that’s no big surprise. No my dear reader, this is not an error I would like to remove by disabling the event validation, because this error is in fact caused by spam bots trying to spam my comments.

They all fail in doing so, because event validation is enabled and thus throwing this exception every time they try. Did I mention to say that event validation is turned on by default and is a native feature of ASP.NET? That means that all ASP.NET application has a natural spam bot protection system build right into it by default. How cool is that?

Maybe this example will convince those of you who didn’t believe me in the last post I did about ASP.NET security and unnecessary CAPTCHAS.

Update 30 minutes later: I've just received 25 more mails in half an hour. Maybe the bots read my post and didn't believe me either.

* Only $4.95/month ASP.NET & Windows 2008 + IIS 7 Hosting! FREE SQL Included

5b5c718d-1b09-4a42-8e09-d78f67085a09|7|4.6

Tags: security, web.config, spam

ASP.NET | Security

Client Callback and Page.IsPostBack I just spend ½ hour trying to find out, why my client callbacks where executing code inside...ASP.NET client-callback – simplicity vs. performance In light of the rising popularity of AJAX during the last couple of years, Microsoft wanted to inc...Do postbacks with parameters in JavaScript Whenever you use a Button or LinkButton it is because you want to be able to do a postback ...

Comments

8/9/2007 1:42:47 PM #

*spam* *spam*

TweeZz |

8/9/2007 3:18:22 PM #

Nice one, TweeZz

Mads Kristensen |

8/9/2007 6:55:42 PM #

I got 1000 errors per month like the one you just mentioned, even from post with comment disabled.
All with weird user agents, like Amiga, Opera 4, Commodore 64... why do bots pretend to be these old style browsers?

Simone |

8/9/2007 8:04:55 PM #

That is just strange that they use those user agents. Could it be that they are more stupid than we are told they are?

Mads Kristensen |

8/9/2007 9:04:59 PM #

A lot of smart-arse webmasters do the same with their server name in the response headers. I've seen things like C64, Spectrums et al. Some spammers think that if they change the user agents because they're clever, and that some programmers will only filter spam by specific user agents, ignoring ones that seem less obvious. Maybe that's how some filters have been written.

Dan Atkinson |

8/9/2007 9:16:56 PM #

That makes sense Dan. you're probably right.

Mads Kristensen |

8/9/2007 10:11:49 PM #

Trackback from DotNetKicks.com

Invalid postback or callback argument

DotNetKicks.com |

8/9/2007 10:48:05 PM #

Hold on there a moment.  I get that same error for a different reason though.  I am using various gridviews on a page where I make them visible or invisible depending on the criteria of the search.  When someone navigates from the page, and come back to it via the BACK button, trying to do something again yields that error.

So that may not be the only reason the error message shows up.  Using CTRL+INSERT, here is the error message:

---------------------------
Windows Internet Explorer
---------------------------
Invalid postback or callback argument.  Event validation is enabled using <pages enableEventValidation="true"/> in configuration or <%@ Page EnableEventValidation="true" %> in a page.  For security purposes, this feature verifies that arguments to postback or callback events originate from the server control that originally rendered them.  If the data is valid and expected, use the ClientScriptManager.RegisterForEventValidation method in order to register the postback or callback data for validation.
---------------------------
OK
---------------------------

Karls |

8/9/2007 10:54:07 PM #

You totally fail for website design. But you've got some very good content brewing in here. Keep it up.

mcgurk |

8/9/2007 11:04:01 PM #

Hang on Karls. It makes perfect sense that you get the error when you use the back-button. The browser and server are no longer in-sync and that is what causes the error. For your particular situation it doesn't make sense to enable event validation, becuase the users are already logged in to do it or it is not needed to prevent bot spammers.

The event validation is excellent to have enabled when you're site is a likely target for spammers.

@mcgurk, what has website design to do with this? Event validation is a bot prevention feature. If you have no trouble with bots, then just turn it off. I do that sometimes, but it very much depends on the project.

Thanks for the feedback

Mads Kristensen |

8/9/2007 11:11:48 PM #

Mads,

Saw your reply, and did not think about this. Checked into it and you were right. I added <pages enableEventValidation="false" /> to into the <system.web> section of the web.config and the problem went away. It seems I was shooting in the dark on that one. I apologize.

Karls

Karls |

8/10/2007 1:21:45 AM #

mcgurk, I just read your comment again and realized that you maybe wrote something funny, but I just didn't get it. You forgot the smiley

Mads Kristensen |

8/10/2007 1:50:04 PM #

Mads, you are a popular spam killer.

mk2 |

8/10/2007 3:11:35 PM #

Would the comment send to email contain a post's title?
Just post link is not experience.

mk2 |

8/10/2007 3:19:45 PM #

!!!!!
It contain the title.....I am blind.

mk2 |

8/13/2007 6:36:30 AM #

Just a heads up, this error can also come from using an event before the page is fully loaded. The problem is that the __EVENTVALIDATION hidden field is at the very bottom of the html, and if you have a big file, a submit action link/button near the beginning, and a client that supports partial rendering, you're in danger of throwing the exception if you have users who are quick and/or know what they're looking for. I had a problem with this just today and got some help through the asp.net forums - the idea is to disable the submitaction on the pages until the page is fully loaded. If you'd like to see the solution I settled with, take a look at forums.asp.net/p/1144649/1853926.aspx#1853926. A better solution would be to move the __EVENTVALIDATION field to the top, near the form tag, but I'm afraid I don't have any idea how to do it.

Eric |

11/22/2007 12:49:33 AM #

Hi
Do you know how to catch this error so that it is not ending up as an unhandled exception in the eventlog?

Mats |

11/22/2007 12:53:27 AM #

You can catch all unhandled exceptions in the global.asax. Take a look here for an example www.velocityreviews.com/.../...-the-exception.html

Invalid postback or callback argument

Am I an idiot?

About the slave

The Lounge

My latest Tweets

Month List

Disclaimer

Invalid postback or callback argument

Am I an idiot?

About the slave

The Lounge

My latest Tweets

Tag cloud

Categories

Month List

Blogroll

Disclaimer