why we need to use web.AllowUnsafeUpdates = true, we don't use these things with traditional ASP.Net Applications?

Question

based on this post When & why I need to use web.AllowUnsafeUpdates = true

"For reasons of security, by default, Microsoft SharePoint Foundation does not allow you to make posts from a Web application to modify the contents of the database unless you include security validation on the page making the request"

but why we don't need such these things when build traditional ASP.Net application? with Entity framework or with traditional ADO.Net I can update database without these restrictions.

Update:

Please provide some examples on Unsafe Updates that not allowed without web.AllowUnsafeUpdates = true. and same example on Safe Updates

Answer 1

There is a couple of reasons for this:

1. SharePoint is from companies point of view a Microsoft product, so if there is a security risk then it's seen as Microsofts fault. This is the reason for Microsoft to putting in a lot of security into SharePoint which by default isn't in ASP.Net like:

   • not running full trust
   • not allowing updates on GETs and unverified POSTs
   • only allowing code to access/update more than the current user is allowed to if the developer explicit tells that this should be allowed want to

2. Traditionelly SharePoint developers developed only part of the page (Web Part) where an ASP.Net developer developer developed the full page. If you don't develop the full page, then it's hard to give this kind of security without a lot of duplicate code if the platform doesn't support it. In ASP.Net then it's up to the individual developer.

This makes it harder to develop for SharePoint, but it makes it easier to develop safe code.

Update to answer update in question:

Examples of Unsafe Updates:

• Any update in a GET HTTP-request as this could be an attempt to cross-site attack example: Attacker has image tag with src set to url to perform update using visitors cached credentials.
• Any update in a POST/PUT/DELETE/MERGE HTTP-request without a valid FormDigest as this could be a replay attack.
• Any update in a HTTP-request done to another site or as another user as Microsoft thinks the developer should really think before doing this.

Examples of safe Updates:

• Any update not due to a HTTP-request. As this isn't from that unsafe Internet.
• An update due to a POST/PUT/DELETE/MERGE HTTP-request with a recent FormDigest from that site and user. As this is the normal way of updating things on the Intranet/Internet.
  • Login
  • Request Page
  • Change something
  • POST/PUT/DELETE/MERGE.

Answer 2

One explanation may be that SharePoint can be exposed to Internet and/or Intranet. As MS does not know what SharePoint will be deployed for, they assumed the best security approach would be best.

For ASP.NET, it's your role as a developper to decide for the security level you want, depending on the exposure of your site.