Reason for FormDigestSettings.Enabled?

Question

I am using SharePoint Server 2007 Enterprise with Windows Server 2008 Enterprise. I have deployed a publishing portal. I am developing a ASP.Net web application using VSTS 2008 + C# + .Net 3.5 + ASP.Net + SharePoint Server 2007 SDK.

I found sometimes we need to use SPWebApplication.FormDigestSettings.Enabled = false in order to walk around, e.g. using SharePoint API to create a site in a site collection. I want to know why we need to execute SPWebApplication.FormDigestSettings.Enabled = false? What is the reason behind the scenes?

Answer 1

First the definition for FormDigestSettings as per MSDN

The security validation is specific to a user, site, and time period and expires after a configurable amount of time. When the user requests a page, the server returns the page with security validation inserted. When the user then submits the form, the server verifies the security validation and if it has changed, program execution is halted and a security exception is raised.

This ensures the request you are sending is genuine,not tweaked or hacked in anyway.This validation is added every time to the page rendered by SharePoint.

Coming back to your question, you wont need to use this FormDigestSettings.Enabled=false always, provided you have the required rights to perform the operation, your code is not running in elevated mode & you are invoking the action from a SharePoint WebSite.

Reason for the last point is all the master pages of SharePoint has this entry

<SharePoint:FormDigest runat=server/>

This entry will make sure that the page is rendered with the FormDigest value. Refer this link for more information.