locked
Does ASP.NET 4.5 enforce MaxHttpCollectionKeys limit RRS feed

  • Question

  • Does ASP.NET 4.5 still throw an exception when MaxHttpCollectionKeys is exceeded?

    We have an ASP.NET web forms page that may submit more than 1000 form items and we previously had to increase the MaxHttpCollectionKeys default limit to get the page to work. I have recently upgraded the project containing this page to .NET 4.5.1 and after removing the MaxHttpCollectionKeys element I now can't reproduce the original problem. I'd like to know if it's safe to remove MaxHttpCollectionKeys from the web.config file but obviously I don't want to re-introduce the original problem.

    This MSDN page for .NET 4.5.1 does include MaxHttpCollectionKeys in its list of appSettings configuration keys and it says the default is 1000.

    I can't find any post that says the limit has been removed or increased in .NET 4.5, but if that's the case why can I submit a page with over 1000 form items? (I used Visual Studio to debug the page request and the Request.Form.Count was 1411). The PC has all security updates applied via Windows Update so as far as I know it should enforce the limit.

    Thanks for any guidance on this.

    Richard

    p.s. I posted this question to the ASP.NET forums several weeks ago but had no response there.
    Wednesday, July 30, 2014 2:46 PM

Answers

  • Thanks for the link to the source. I've had a look at it and can see that AppSettings.MaxHttpCollectionKeys is initialised to Int32.MaxValue.

    I've also used ILSpy to look at the .NET frameworks installed on my development PC. The 4.0 framework does indeed use Int32.MaxValue for the default value. However the 2.0 framework uses 1000 for the default value.

    So it looks like the default value has changed in .NET 4.5.1, which explains why I don't get an exception when the form input count exceeds 1000 items. Unfortunately the MSDN library appears to be out-of-date and still shows 1000 as the default value (which was the cause of my confusion):

    http://msdn.microsoft.com/en-us/library/hh975440.aspx

    Thanks again for the help.

    Richard

    Thursday, August 7, 2014 2:05 PM

All replies

  • Hi Richard,

    If you don’t set MaxHttpCollectionKeys in app.config, the default value will be 1000. When you send post request and from count more than 1000, the server handler will throw InvalidOperationException. Someone has tested this scenario, you can see more information from http://stackoverflow.com/questions/8684049/asp-net-ms11-100-how-can-i-change-the-limit-on-the-maximum-number-of-posted-for.

    And explanation on MSDN, http://msdn.microsoft.com/en-us/library/hh975440.aspx.

    Hope useful.

    Regards,


    We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place. <br/> Click <a href="http://support.microsoft.com/common/survey.aspx?showpage=1&scid=sw%3Ben%3B3559&theme=tech"> HERE</a> to participate the survey.

    Thursday, July 31, 2014 2:13 AM
  • Hi, thanks for your response.

    Yes I understand what should happen, but I have a page that posts over 1000 Form items and I don't get an exception

    Previously this page was using .NET 1.1 and it did get the exception, which I resolved by applying the registry workaround (as described in the StackOverflow post you linked to). I've now finally been able to upgrade this project to .NET 4.5.1 (where the workaround is in the web.config file instead of the registry) and I don't see the exception.

    If I should still get the exception in .NET 4.5.1 then I'd like to understand why I'm not getting it. Perhaps I'm missing a security patch?

    Thanks.

    (apologies if this question is off-topic, but I posted this to the ASP.NET forums over 6 weeks ago and haven't had a reply there)


    Thursday, July 31, 2014 9:17 AM
  • Hi Richard,

    You’re always welcome here.

    > If I should still get the exception in .NET 4.5.1 then I'd like to understand why I'm not getting it. Perhaps I'm missing a security patch?

    If you doubt the behavior of ASP.NET, I think you should do some research. From the source code of HttpValueCollection from http://referencesource.microsoft.com/#System.Web/xsp/system/Web/HttpValueCollection.cs, we can see ThrowIfMaxHttpCollectionKeysExceeded method is called by construct, FillFromString, FillFromEncodedBytes and Add methods. You can do some test to check the from collectionkey count and AppSettings.MaxHttpCollectionKeys property.

    You can also post some code here to help me reproduce this problem. Use OneDrive and share a link here if possible.

    Regards,


    We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place. <br/> Click <a href="http://support.microsoft.com/common/survey.aspx?showpage=1&scid=sw%3Ben%3B3559&theme=tech"> HERE</a> to participate the survey.

    Friday, August 1, 2014 2:25 AM
  • Thanks for the link to the source. I've had a look at it and can see that AppSettings.MaxHttpCollectionKeys is initialised to Int32.MaxValue.

    I've also used ILSpy to look at the .NET frameworks installed on my development PC. The 4.0 framework does indeed use Int32.MaxValue for the default value. However the 2.0 framework uses 1000 for the default value.

    So it looks like the default value has changed in .NET 4.5.1, which explains why I don't get an exception when the form input count exceeds 1000 items. Unfortunately the MSDN library appears to be out-of-date and still shows 1000 as the default value (which was the cause of my confusion):

    http://msdn.microsoft.com/en-us/library/hh975440.aspx

    Thanks again for the help.

    Richard

    Thursday, August 7, 2014 2:05 PM