I'm getting weird error with publishing pages and form digest. When publishing page is in Published state __REQUESTDIGEST hidden field value is "InvalidFormDigest". I also have Notes web part on this page. So this invalid digest value doesn't let me and any user to submit comments. I enabled verbose logging for social data and found the following error in logs:

argument:<Item  type='Add'><Title>test1</Title><RTEContents>dwd</RTEContents></Item>
,message:The security validation for this page is invalid. Click Back in your Web browser, refresh the page, and try your operation again.
,request:<Item  type='Add'><Title>test1</Title><RTEContents>test</RTEContents></Item>

Does anyone know why this might happen and how to troubleshoot __REQUESTDIGEST issues?

Thank you in advance.

  • do you have custom code running on the page? if so this may help blog.crsw.com/2011/04/23/validateformdigest Apr 5, 2013 at 19:46
  • No, this is completely out of the box site collection based on Publishing Portal template. The thing is that request digest is validated, but it contains "InvalidFormDigest" string which is obviously not valid.
    – Vadim
    Apr 5, 2013 at 20:03
  • Did you find a solution yet. I have exact same problem with everything OOB for my publishing site and see InvalidFormDigest on my page. Please let me know if you have found a fix. Thanks.
    – user16343
    Apr 14, 2013 at 21:23
  • We contacted MS Support regarding this issue. They said that one of Windows updates breaks form digest generation. They confirmed that it should be fixed in the next CU - June 2013 or whatever comes next.
    – Vadim
    May 31, 2013 at 16:13

2 Answers 2


Been looking into this problem as well.

Apparently, around the Feb 2013 CU, code was introduced into the FormDigest control that checks whether or not the digest can be included in the output cache. In this case, the page must be published and the UseDefaultCachePolicy is false.

In this instance (Published and UseDefaultCachePolicy == false), it will return InvalidFormDigest.

More digging leads to the fact that any publishing layout inherits from PublishingCacheablePage, which calls PublishingHttpModule.DisableWSSCacheHeaders() when context is set. Since a publishing page layout is inheriting, this call happens for all Publishing Layout pages.

When the module executes DisableWSSCacheHeaders() it sets SPContext.Current.UseDefaultCachePolicy to false.

This happens whether or not you have output cache enabled.

The only way(s) I've found around this are:

  1. Create a new FormDigest control that always spits out the actual form digest
  2. Disable security validation for the web app
  3. Create a control that calls PublishingHttpModule.DontEnableCachingForRequest

Unfortunately, I've not found a "fix" for this, as the code that's running (as of Feb 2013) is "out of the box" and will always set these values for publishing layout pages.

  • Do we have any news regarding if this has been resolved? Experiencing similar problems on an SP2 Jun 16, 2014 at 10:27

See http://blogs.technet.com/b/stefan_gossner/archive/2013/04/10/april-2013-cu-for-sharepoint-2010-has-been-released.aspx which our testing to date suggests it does work round the problem with NOTE BOARD webpart

  • While this may theoretically answer the question, we prefer inclusion of the essential parts of the answer here, and to provide the link for reference. You could perhaps add a brief précis of the relevant part of the blog article (in this case really just a link to the CU). See answer for general guidelines.
    – SPDoctor
    May 30, 2013 at 8:49
  • We are on April 2013 CU and unfortunately "InvalidFormDigest" is still reproducible.
    – Vadim
    May 31, 2013 at 16:09
  • This article saved my day May 8, 2014 at 11:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.