ASP.NET Web Forms Protection

If you run an ASP.NET website on IIS, you may find repeated "A potentially dangerous Request.Form value was detected" errors in the Windows Application log. Automated tools can repeatedly submit unwanted HTML, scripts and malformed input to your forms, consuming server resources and generating large numbers of validation errors.

A typical request validation event contains information like this. Server and application details are illustrative; the submitted value is omitted:

Log Name:          Application
Source:            ASP.NET 4.0.30319.0
Event ID:          1309
Task Category:     Web Event
Level:             Warning
Keywords:          Classic
Computer:          WEB-SERVER

Description:
Event code:        3003
Event message:     A validation error has occurred.
Event detail code: 0

Application information:
    Trust level: Full
    Application Virtual Path: /
    Application Path: C:\inetpub\wwwroot\example.net\
    Machine name: WEB-SERVER

Process information:
    Process ID: 3276
    Process name: w3wp.exe
    Account name: IIS APPPOOL\ExampleAppPool

Exception information:
    Exception type: HttpRequestValidationException
    Exception message: A potentially dangerous Request.Form value was detected from the client (submitted value omitted).
   at System.Web.HttpRequest.ValidateString(String value, String collectionKey, RequestValidationSource requestCollection)
   at System.Web.HttpRequest.ValidateHttpValueCollection(HttpValueCollection collection, RequestValidationSource requestCollection)
   at System.Web.HttpRequest.get_Form()
   at System.Web.HttpRequest.get_HasForm()
   at System.Web.UI.Page.GetCollectionBasedOnMethod(Boolean dontReturnNull)
   at System.Web.UI.Page.DeterminePostBackMode()
   at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
   ...

Request information:
    Request URL: https://example.net/index.aspx
    Request path: /index.aspx
    User host address: 5.136.158.160
    User:
    Is authenticated: False
    Authentication Type:
    Thread account name: IIS APPPOOL\ExampleAppPool

ASP.NET may already reject these requests, but the same source can keep sending more. Your server still spends processor time, memory, bandwidth and log space handling them. Repeated probes can also make genuine application errors harder to find among thousands of similar log entries.

RdpGuard helps stop this repeated activity. It monitors ASP.NET events in the Application log, identifies requests that match its detection rules and temporarily blocks the source IP address when detections reach your configured limit. During the blocking period, that address can no longer continue sending requests to the protected server ports.

Start with the standard rules for request validation errors, or customize detection to match the events produced by your applications. You can adjust the blocking limit and duration, whitelist trusted addresses, and receive notifications when an IP address is blocked.

A validation error alone does not prove an attack: legitimate users can also trigger it by entering HTML into a form. Review the events your site produces and choose rules that fit its expected input. Keep ASP.NET and your application updated, and retain appropriate input validation and output encoding.

This protection uses the Windows events generated by classic ASP.NET on .NET Framework. It works with HTTP and HTTPS because it reads logged events. It requires a client IP in the event and does not automatically cover every ASP.NET Core application or every type of website attack.

How to enable and configure ASP.NET Web Forms protection - enable monitoring, check logged events and adjust blocking settings.

Custom detection rules for ASP.NET Web Forms - match EventData fields and tailor detection to your application.