AllowUnsafeUpdate on POST request

Question

I am getting good old "The security validation for this page is invalid" on Sharepoint 2013, while updating list in Sharepoint, due to button click on an application page.

In browser, I clearly see, that this is a POST request. While debugging, I clearly see Context.Request.HttpMethod == "POST".

I've tried adding FormDigest tag and calling ValidateFormDigest -- did not help.

What helped was the following:

using (SPWeb web = CurrentSite.OpenWeb())
{
        web.AllowUnsafeUpdates = true;
        // List update here 
        web.AllowUnsafeUpdates = false;
}

On MSDN, it is stated, that AllowUnsafeUpdates works only for GET requests.

How is that happening, that it is required even for my POST request? Am I doing everything correct?

Answer 1

The point is: you open a new SPWeb object (i.e. you don't use the contextual SPContext.Current.Web managed automatically by SharePoint on each request). Therefore, no FormDigest can help here: FormDigest ensures security on POST request for the contextual SPWeb only.

AllowUnsafeUpdates helps here because it deactivates the security checks (both for GET and for POST requests).
The documentation mentions GET requests only, since they always consider you use the contextual SPWeb: for contextual SPWeb, only GET requests may need AllowUnsafeUpdates, since POST are always OK thanks to the FormDigest control injected via the master page.