Request Validation in ASP.NET 4.0

As we know that request validation was enabled by default in previous versions of ASP.NET. But it was only applicable for ASPX.NET pages i.e. only for aspx files and their class files. Basically request validation provides a certain level of protection against cross-site scripting (XSS) attacks.  

In ASP.NET 4.0, request validation is enabled for all requests as it is enabled before the BeginRequest phase of an HTTP request. Thus, request validation is applicable for all ASP.NET resources requests, not just .aspx page requests but also for Web service calls, custom HTTP handlers and content reading of HTTP request by custom HTTP modules.

Due to this new feature in ASP.NET 4.0, some new request validation errors might now occur for requests that previously did not trigger errors.  There errors help to find out whether existing handlers, modules, or other custom code accesses potentially unsafe HTTP inputs that could be XSS attack vectors.

You can revert back the ASP.NET 2.0 behavior of request validation feature, by adding the following in the Web.config file:

<httpRuntime requestValidationMode="2.0" />

This is also notable feature of ASP.NET 4.0.