Error: The security validation for this page is invalid

Question

I have as simple function to just upload 1 document in 1 library. I made a REST service as part of a SharePoint solution which I deploy/debug against sp2013.

However the list.Rootfolder.Files.Add gives me a "the security validation for this page is invalid"

    static public void UploadFileInLib(string subfolderPath, string fileName, byte[] doc)
    {
        //Microsoft.SharePoint.Utilities.SPUtility.ValidateFormDigest();

        SPSite site1 = SPContext.Current.Site;

        SPUserToken sysToken = SPContext.Current.Site.SystemAccount.UserToken;
        if (sysToken == null)
        {
           SPSecurity.RunWithElevatedPrivileges(delegate()
           {
               using (SPSite site2 = new SPSite(site1.ServerRelativeUrl))
                {
                    sysToken = site2.SystemAccount.UserToken;
                }
           });
        }

        using (SPSite site2 = new SPSite(site1.Url, sysToken))
        {
            using (SPWeb web = site2.OpenWeb(site1.Url))
            {
                string uploadPathRoot = site2.ServerRelativeUrl + "/Lists/abc";
                SPList list = web.GetList(uploadPathRoot);
                var fcp = new Microsoft.SharePoint.SPFileCollectionAddParameters();
                fcp.Overwrite = true;
                list.RootFolder.Files.Add(fileName, doc, fcp);
             }
         }
    }

Answer 1

Try using web.Allowunsafeupdates = true;

string uploadPathRoot = site2.ServerRelativeUrl + "/Lists/abc";
SPList list = web.GetList(uploadPathRoot);
var fcp = new Microsoft.SharePoint.SPFileCollectionAddParameters();
fcp.Overwrite = true;
web.AllowUnsafeUpdates = true;
list.RootFolder.Files.Add(fileName, doc, fcp);
web.AllowUnsafeUpdates = false;

Answer 2

The usual approach is to perform

SPUtility.ValidateFormDigest();

in order to check the validity of the request.

Answer 3

When I added the X-RequestDigest header to the JavasScript Proxy to the REST Service it all fell into place.

Add {"X-RequestDigest": $("#__REQUESTDIGEST").val()} to the headers send.