The product of a web developer with a little too much caffeine

The Super Secure HttpRequest

with 3 comments

I’ve been working on a little project lately to see if it is possible to use WebControl inline with ASP.NET MVC. It’s been going well so far, but I encountered a little, tiny, insignificant problem… actually, it’s quite a big problem.

The general idea behind the project was to display the normal view, use the inline code to create a second instance of a page, render the content with the correct ViewState information, and then output the content back onto the ViewPage so it can be used.

Now passing a ViewState into the wrong type of page causes some problems. To get around it we simply rename our ViewState to something else and then change the name back when the page is being loaded in our code. It worked well when I was creating a new HttpRequest object, but the problem is that if you create one manually, it changes to a GET request — not a POST!

At first I figured that I would just get in there and reuse the same HttpRequest and make a few changes, but it wasn’t going to be that easy. The problem is that you just can’t do anything to the HttpRequest — Anything!! Try to change the parameters? Read-Only. Try to inherit from the StateBag? Sealed. Inherit from the HttpRequest itself? Sealed! Holy cow!!

I’ve been battling this quite a bit and at this point I’m feeling defeated (and a little grumpy). I’m trying to find a point that I can make a change to the incoming data, but before the ViewState is loaded by the WebForm page.

After going round and round for awhile I’m starting to think my best (maybe only) option is to get work with the HttpApplication class. Not exactly what I was hoping for, but it may be my only option at this point.

… let’s just hope not everything is read only in this class as well.


Written by hugoware

August 10, 2009 at 1:47 am

3 Responses

Subscribe to comments with RSS.

  1. It is a bit tricky, but you can use Filter property of HttpRequest object and get access to raw request data.
    Read this stream, find renamed viewstate field (“__viewstat_” for example) and rename it to “__viewstate” 🙂


    August 10, 2009 at 8:21 pm

    • Interesting – I use the Response.Filter often, but didn’t really think about the Request.Filter.

      As it turns out, there is a method for the Page class called something like “LoadViewStateFromPersistanceMedium()” or something like that — it ended up working exactly the way I was hoping.

      Thanks for the suggestion though, I’m going to definitely check that out – I’ve wanted a way to interact with the incoming data for sometime now, but that Request.Filter never occurred to me.



      August 10, 2009 at 8:44 pm

  2. […] to VoteThe Super Secure HttpRequest (8/9/2009)Sunday, August 09, 2009 from webdev_hbI’ve been working on a little project lately to see if it is […]

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: