title: Using ValidateRequest="true" with HttpHandlers
body: <p>I have an HTTP Handler set up in the HttpHandlers section of my web.config as follows:</p>
  
  <pre><code>&lt;add path="myNamespace.myHandler.axd" verb="*" type="myNamespace.myHandler, myNamespace" validate="false"/&gt;
  </code></pre>
  
  <p>A PCI scan has highlighted a vulnerability within this handler, which opens it up to XSS attacks.  Basically you can pass a  tag in via the querystring and the httphandler dumps the  tag straight into the response in its raw format - ouch!</p>
  
  <p>I don't have access to the source code for this handler, so I have been trying to close this vulnerability using asp.net with the following  tag:</p>
  
  <pre><code>&lt;location path="myNamespace.myHandler.axd"&gt;
      &lt;system.web&gt;
          &lt;pages validateRequest="true"&gt;
          &lt;/pages&gt;
      &lt;/system.web&gt;
  &lt;/location&gt;
  </code></pre>
  
  <p>This however is not working.  The querystring is not being validated, and the  tags are still getting through.</p>
  
  <p>I am running IIS7 with asp.net 3.5.</p>
  
  <p>Can anyone help?</p>
  
  <p>Cheers,
  Pat</p>