title: Why am I getting the "A potentially dangerous Request.Form value was detected from the client" error?
body: <p>I've created a new ASP.NET MVC 3 / .NET Framework 4.0 site using the "Internet Application" template. I used Nuget to install the <a href="http://www.nuget.org/List/Packages/WindowsAzure.WebRole.MVC3" rel="noreferrer">Windows Azure Web Role (MVC3)</a> package and then followed the <a href="http://acs.codeplex.com/wikipage?title=Getting%20Started&amp;referringTitle=Documentation" rel="noreferrer">Access Control Service walkthrough</a> to set up Windows Live ID and Google authentication.</p>
  
  <p>Soon enough, I came across the "A potentially dangerous Request.Form value was detected from the client" error and followed the <a href="http://social.technet.microsoft.com/wiki/contents/articles/windows-identity-foundation-wif-a-potentially-dangerous-request-form-value-was-detected-from-the-client-wresult-quot-lt-t-requestsecurityto-quot.aspx" rel="noreferrer">article in the Windows Identity Foundation wiki</a> to try and resolve it. Unfortunately nothing I've tried works, including:</p>
  
  <ul>
  <li><p>Setting <code>&lt;httpRuntime requestValidationMode="2.0"/&gt;</code> and <code>&lt;pages validateRequest="false"&gt;</code> in both the root web.config and Views\web.config</p></li>
  <li><p>Copying <code>SampleRequestValidator</code> from the WIF SDK into the project and setting <code>&lt;httpRuntime requestValidationType="SampleRequestValidator"/&gt;</code> in both web.configs</p></li>
  </ul>
  
  <p>I've also tried variations of these without success.</p>
  
  <p><strong>Any ideas?</strong></p>
  
  <p>Here's the complete exception:</p>
  
  <hr>
  
  <p><strong>Exception Details:</strong> System.Web.HttpRequestValidationException: A potentially dangerous Request.Form value was detected from the client (wresult="<code>&lt;t:RequestSecurityTo...</code>").</p>
  
  <p><strong>Description:</strong> Request Validation has detected a potentially dangerous client input value, and processing of the request has been aborted. This value may indicate an attempt to compromise the security of your application, such as a cross-site scripting attack. To allow pages to override application request validation settings, set the requestValidationMode attribute in the httpRuntime configuration section to requestValidationMode="2.0". Example: <code>&lt;httpRuntime requestValidationMode="2.0" /&gt;</code>. After setting this value, you can then disable request validation by setting validateRequest="false" in the Page directive or in the <code>&lt;pages&gt;</code> configuration section. However, it is strongly recommended that your application explicitly check all inputs in this case. For more information, see <a href="http://go.microsoft.com/fwlink/?LinkId=153133" rel="noreferrer">http://go.microsoft.com/fwlink/?LinkId=153133</a>. </p>
  
  <p><strong>Stack Trace:</strong></p>
  
  <p>[HttpRequestValidationException (0x80004005): A potentially dangerous Request.Form value was detected from the client (wresult="<code>&lt;t:RequestSecurityTo...</code>").]</p>
  
  <pre>
  System.Web.HttpRequest.ValidateString(String value, String collectionKey, RequestValidationSource requestCollection) +8755668
  System.Web.HttpRequest.ValidateNameValueCollection(NameValueCollection nvc, RequestValidationSource requestCollection) +122
  System.Web.HttpRequest.get_Form() +114
  Microsoft.IdentityModel.Web.WSFederationAuthenticationModule.IsSignInResponse(HttpRequest request) +75
  Microsoft.IdentityModel.Web.WSFederationAuthenticationModule.CanReadSignInResponse(HttpRequest request, Boolean onPage) +205
  Microsoft.IdentityModel.Web.WSFederationAuthenticationModule.CanReadSignInResponse(HttpRequest request) +41
  Microsoft.IdentityModel.Web.WSFederationAuthenticationModule.OnAuthenticateRequest(Object sender, EventArgs args) +117
  System.Web.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +148
  System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +75
  </pre>
  
  <hr>