Wednesday 30 April 2008

Invalid postback or callback argument.

Ok so I have been playing with .Net Membership and Roles recently and have added a new login to a website's backend. Now I added a simple sign out button that invokes the forms authentication signout method and added it to the backend. This worked as expected for all the pages except one.


On one of my pages I am currently using an iFrame to pull in some content, until I integrate it properly. If you tried to signout from this page the following error occurs:

Invalid postback or callback argument. Event validation is enabled using in configuration or <%@ Page EnableEventValidation="true" %> in a page. For security purposes, this feature verifies that arguments to postback or callback events originate from the server control that originally rendered them. If the data is valid and expected, use the ClientScriptManager.RegisterForEventValidation method in order to register the postback or callback data for validation.

This I thought was odd, and as it only occured on this page I guessed it was something specific to this page. My first thought was to temporarily disable EventValidation, this however didn't fix the problem.


I next turned to the source code, initially everything looked OK. However what I failed to notice was I had entered my iFrame as below:


<iframe src="/somewhere" id="something" width="800px" height="1000px"  frameborder="0" />

I had wrongly made the iframe self closing. Changing this to the valid way:


<iframe src="/somewhere" id="something" width="800px" height="1000px"  frameborder="0">
</iframe>

fixed my event validation error and all was great.


I would love to know the reason behind this, I'm thinking its down to what the server expects the iframe to be and what the source says but I'm not sure. More interestingly hoever is that Visual Studio doesn't flag the invalid iframe as an error or a warning, unlike most other invalid HTML.

1 comment:

c- dm said...

Adding a runat=server attribute to the iframe also seems to fix the problem. This seems to lend support to your theory about why this is happenening. Page processes and sends the iframe down to the client with no changes, the browser "fixes" the tag and when the posted value is different, kablooie. Thanks for the tip!