Is CommandArgument attribute validation required (used with ASP.NET Relay)?

Question

Can a CommandArgument file sent to the ItemCommand event via RepeaterCommandEventArgs faked by the client?

In the code base I'm working on, this contains the identifier of the deleted record, which may or may not belong to the registered user. I am wondering if this value needs to be checked before performing the deletion.

Answer 1

CommandArgument was not found in html or sent as plain text because there are input values, but it is part of the ViewState (which is stored in a hidden field). If you do not encrypt the ViewState, or if someone can decrypt it, this can be manipulated.

See one of these links for more information on forcing ViewState encryption:

• http://msdn.microsoft.com/en-us/library/aa479501.aspx (.NET2)
• http://msdn.microsoft.com/en-us/library/bb386448%28v=vs.100%29.aspx#SecuringViewState (.NET4)