When & why I need to use web.AllowUnsafeUpdates = true, and why it is false by default:
web.AllowUnsafeUpdates = true;
//Update Item
web.AllowUnsafeUpdates = false;
-
1In a few rare scenarios, blindly setting it to false after doing the updates may caues issues, with other out-of-the-box code or with other custom code. It is a safer habit to save the original value Before changing it, then changing it back to the original value when done.– JanErikGunnarCommented Apr 2, 2017 at 21:50
Add a comment
|
2 Answers
For reasons of security, by default, Microsoft SharePoint Foundation does not allow you to make posts from a Web application to modify the contents of the database unless you include security validation on the page making the request. You can update data for a single site or for a site collection by adding a page directive and a FormDigest control to the page that makes the request.
To GET the content from the content DB, we need to set the AllowUnsafeUpdates = true. To POST the content to the content DB, not require to set the AllowUnsafeUpdates = true. why means because of "FormDigest" control placed in every master page.
When/where/why use "AllowUnsafeUpdates" in SharePoint?
answered Apr 6, 2015 at 15:55
-
6This answer is correct from a technical perspective. However, there are no valid scenarios in which custom code should use AllowUnsafe. If you are writing custom code, you should use the FormDigest or first make a call to _api/contextinfo. Commented Apr 7, 2015 at 1:39
-
3I think there's still an error. You need unsafe updates allowed to make updates during the processing of a GET request, not to GET data from database. Commented Apr 8, 2015 at 7:46
-
unfortunately i can't understand the answer, it seem correct, but is there an simple way to describe it. why we don't need something like this with ASP.net Applications?– jobinCommented Apr 9, 2015 at 7:24
-
-
@jobin Say you have a list and you want to update something to the SharePoint data [content DB], then you need to set AllowUnsafeUpdates = true for the web and after you have done you need to set it back to false.– Waqas Sarwar MVP ♦Commented Apr 9, 2015 at 20:39
WHY --> to prevent your code from cross site scripting.
If you are updating content DB using a POST request then you should use SPUtility.ValidateFormDigest() to validate the current request and after that you will not have to worry about AllowUnsafeUpdates, because its default value will be “true” after the form digest is validated. The Microsoft idea behind introducing the AllowUnsafeUpdates property is to protect you from cross-site scripting attacks.
If you are using GET request to update the sharepoint objects then it will throw an exception System.Exception: Microsoft.SharePoint.SPException bcoz your code will be exploitable via a cross-site scripting. To prevent this CSS you have to set AllowUnsafeUpdates to true and after changes make it to false or whatever the previous value.
Also If the HTTPContext.Current is null then AllowSafeUpdates will be always true. This is the case in rich clients where no cross-scripting is possible as there are simply no web requests.
