By default, web application web.configs have validateRequest="false". Changing it to true breaks SharePoint significantly, based on my own trials. People Pickers don't work, half the form pages don't work, etc.

This option, as I understand it, blocks any HTTP requests that contain any HTML. Which seems to be quite a lot of things in SharePoint.

Is there any work around to this? Or does SharePoint just not support this setting?

  • why you need to set validateRequest=“true”? Commented Jul 24, 2017 at 22:30

1 Answer 1


We had the same question. During a ethical security scan we where advised to enable this option. We tested what would happen if we enabled this option. Some list forms stopped working. For example because there was a rich html field present on the form. We contacted Microsoft support about this and they told us that enabling this option in the web.config is unsupported.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.