{"id":4641,"date":"2012-10-20T02:45:26","date_gmt":"2012-10-20T02:45:26","guid":{"rendered":"https:\/\/test.simple-talk.com\/uncategorized\/sharepoint-http-modules-and-page-validation\/"},"modified":"2016-07-28T10:52:04","modified_gmt":"2016-07-28T10:52:04","slug":"sharepoint-http-modules-and-page-validation","status":"publish","type":"post","link":"https:\/\/www.red-gate.com\/simple-talk\/blogs\/sharepoint-http-modules-and-page-validation\/","title":{"rendered":"SharePoint, HTTP Modules, and Page Validation"},"content":{"rendered":"<p>Sometimes I really believe that SharePoint actively thwarts my attempts to get it to do what I want.  First you look at something and say, wow, that should work.  Then you realize it doesn&#8217;t.  Then you have an epiphany and see a workaround.  And when you almost have that work around working&#8230; well then SharePoint says no again.  Then it&#8217;s off on another whirl-wind adventure to find a work around for the workaround.  I had one of those issues today, but I think I finally got past the last roadblock.<\/p>\n<p>So, I was writing an HTTP module as a workaround for another problem.  Everything looked like it was working great because I had been slowly adding code into the HTTP module bit by bit in a prototyping effort.  Finally I put in the last bit of code in place&#8230; and I started to get an error:<\/p>\n<p><strong>&#8220;The security validation for this page is invalid. Click Back in your Web browser, refresh the page, and try your operation again.&#8221;<\/strong><\/p>\n<p>This is not an uncommon error &#8211; it normally occurs when you are updating an item on a GET request and you have not marked the web containing the item with <strong>AllowUnsafeUpdates<\/strong>.  One issue, however, is that I wasn&#8217;t updating anything in my code.  I was, however, getting an <strong>SPWeb<\/strong> object so I decided to set the <strong>AllowUnsafeUpdates<\/strong> property on it to <strong>true<\/strong> for good measure. Once that was in place, I ran it again&#8230;<\/p>\n<p><strong>&#8220;The security validation for this page is invalid. Click Back in your Web browser, refresh the page, and try your operation again.&#8221;<\/strong><\/p>\n<p>WTF?!?!  I really expected that setting the <strong>AllowUnsafeUpdates<\/strong> property on the <strong>SPWeb<\/strong> would fix the issue, but clearly that was not the case.  I have had occasion to disassemble some SharePoint code with <a href=\"http:\/\/www.reflector.net\/sharepoint\/?utm_source=simpletalk&amp;utm_medium=blog&amp;utm_content=damonsharepoint&amp;utm_campaign=reflector\">.NET Reflector<\/a> in the past, and one of the things SharePoint abuses a bit more than it should is the <strong>HttpContext<\/strong>.  One way to avoid this abuse is to clear out the <strong>HttpContext <\/strong>while your code runs and then set it back once you are done.<\/p>\n<p>I tried this next, and everything worked out just like I had expected.  So, if you are building an HTTP Module for SharePoint and some code that you are running ends up giving you a security validation error, remember to try running that code with <strong>AllowUnsafeUpdates<\/strong> turned on and try running the code with the <strong>HttpContext<\/strong> nulled out (just remember to set it back after your code runs or else you&#8217;ll really jack things up).<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Sometimes I really believe that SharePoint actively thwarts my attempts to get it to do what I want. First you look at something and say, wow, that should work. Then you realize it doesn&#8217;t. Then you have an epiphany and see a workaround. And when you almost have that work around working&#8230; well then SharePoint&#8230;&hellip;<\/p>\n","protected":false},"author":46738,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[2],"tags":[],"coauthors":[],"class_list":["post-4641","post","type-post","status-publish","format-standard","hentry","category-blogs"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.red-gate.com\/simple-talk\/wp-json\/wp\/v2\/posts\/4641","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.red-gate.com\/simple-talk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.red-gate.com\/simple-talk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.red-gate.com\/simple-talk\/wp-json\/wp\/v2\/users\/46738"}],"replies":[{"embeddable":true,"href":"https:\/\/www.red-gate.com\/simple-talk\/wp-json\/wp\/v2\/comments?post=4641"}],"version-history":[{"count":6,"href":"https:\/\/www.red-gate.com\/simple-talk\/wp-json\/wp\/v2\/posts\/4641\/revisions"}],"predecessor-version":[{"id":42243,"href":"https:\/\/www.red-gate.com\/simple-talk\/wp-json\/wp\/v2\/posts\/4641\/revisions\/42243"}],"wp:attachment":[{"href":"https:\/\/www.red-gate.com\/simple-talk\/wp-json\/wp\/v2\/media?parent=4641"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.red-gate.com\/simple-talk\/wp-json\/wp\/v2\/categories?post=4641"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.red-gate.com\/simple-talk\/wp-json\/wp\/v2\/tags?post=4641"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.red-gate.com\/simple-talk\/wp-json\/wp\/v2\/coauthors?post=4641"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}