title: A potentially dangerous Request.Form value was detected from the client with generic http handler
body: <p>I'm having an issue with a generic http handler I have written for a site running on IIS6 using ASP.NET v2.0. The job of the handler is to accept a post from a third-party site, do some translating of the data, and then forward it along via a post to another site. This all works fine. The issue i'm having is that some of the POST's to my handler fail, with this message:</p>
  
  <pre><code>2013-11-03 00:22:39 Message: A potentially dangerous Request.Form value was 
  detected from the client (data.xml="&lt;?xml version='1.0'?...")
  </code></pre>
  
  <p>Every post that this third-party site does to my handler includes the data in two formats in the post. data.json contains the data in a json format, and data.xml contains the data in an xml format. I'm not sure why the site does it this way, you can't configure which formats they send, they just always send the data both ways.</p>
  
  <p>As this is an ASP.NET v2 site, <code>&lt;httpRuntime requestValidationMode="2.0" /&gt;</code> isn't supported (and I wouldn't want to turn it off site-wide anyways, this is a large site). I've also attempted to turn off validation with this in my web.config:</p>
  
  <pre><code>&lt;configuration&gt;
    &lt;deleted details /&gt;
    &lt;location path="~/Handlers/PostTranslator.ashx"&gt;
      &lt;system.web&gt;
        &lt;pages validateRequest="false" /&gt;
      &lt;/system.web&gt;
    &lt;/location&gt;
    &lt;deleted details /&gt;
  &lt;/configuration&gt;
  </code></pre>
  
  <p>The above change didn't seem to make a difference.</p>
  
  <p>Is there some obvious way to turn off Request.Form validation that i've missed? Or some limitation since this is a generic http handler?</p>
  
  <p>The code that throws the error is simple:</p>
  
  <pre><code>public void ProcessRequest(HttpContext context) {
      var form = context.Request.Form;
  }
  </code></pre>
  
  <p>The handler is registered in the web.config like this (if it matters):</p>
  
  <pre><code>&lt;add verb="*" path="PostTranslator.ashx" 
        type="My.Web.UI.Site.Handlers.PostTranslator, My.Web.UI.Site" /&gt;
  </code></pre>
  
  <p>Here is the output when running <code>aspnet_regiis -lk</code> (running as 64bit):</p>
  
  <pre><code>W3SVC/9755868907/root    2.0.50727.0
  </code></pre>
  
  <p>Is there a way for me to turn off form validation for just this http handler?</p>