Thursday, 2 February 2012

InvalidOperationException in System.Web.HttpValueCollection.ThrowIfMaxHttpCollectionKeysExceeded

On   In , ,    → 21 comments  edit
A Microsoft patch for ASP.Net released on the 29th of December 2011 adds a new functionality that rejects POST http requests with more than 1000 keys and any JSON http request with more than 1000 members. That is pretty huge, and if you have encountered this exception:
Operation is not valid due to the current state of the object.

Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.InvalidOperationException: Operation is not valid due to the current state of the object.

Source Error:
An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.

Stack Trace:
[InvalidOperationException: Operation is not valid due to the current state of the object.]
System.Web.HttpValueCollection.ThrowIfMaxHttpCollectionKeysExceeded() +2692302
System.Web.HttpValueCollection.FillFromEncodedBytes(Byte[] bytes, Encoding encoding) +61
System.Web.HttpRequest.FillInFormCollection() +148

[HttpException (0x80004005): The URL-encoded form data is not valid.]
System.Web.HttpRequest.FillInFormCollection() +206
System.Web.HttpRequest.get_Form() +68
System.Web.HttpRequest.get_HasForm() +8735447
System.Web.UI.Page.GetCollectionBasedOnMethod(Boolean dontReturnNull) +97
System.Web.UI.Page.DeterminePostBackMode() +63
System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +133

then your site has been affected by this patch.

Well, you probably know that something is wrong with the design of a page that sends 1000 POST values, but still, let's assume you are in a situation where you cannot change the design of the application and you just want the site to work. Never fear, use this:

<configuration xmlns=”http://schemas.microsoft.com/.NetConfiguration/v2.0″>
<appSettings>
 <add key="aspnet:MaxHttpCollectionKeys" value="5000" />
 <add key="aspnet:MaxJsonDeserializerMembers" value="5000" />
</appSettings>
</configuration>


More details:
Knowledge base article about it
The security advisor for the vulnerability fixed
The entire MS11-100 security update bulletin

21 comments:

  1. Anonymous22 February 2012 at 02:45

    Brilliant post, thanks very much for this it helped a lot.

    It really confused me as it wasn't even getting anywhere near the code behind before giving me this error.

    ReplyDelete
  2. Anonymous23 February 2012 at 01:58

    Thanks allot, this helped me to resolve my problem too. Great blog.
    thanks with regards
    S

    ReplyDelete
  3. Anonymous15 March 2012 at 05:41

    Great job.

    ReplyDelete
  4. Anonymous19 April 2012 at 00:02

    You are AWESOME, thanks a lot this helped me solve my error immediatly after spending hours of trouble shooting and debugging I finally managed to find out what the issue was - thank you very much for supplying this valuable piece of information!

    ReplyDelete
  5. kgmail20 April 2012 at 05:48

    3 days of debugging then found this post. thnx!!

    ReplyDelete
  6. Anonymous23 May 2012 at 10:38

    Thank you!! Spent the last 4 hours trying to fix this issue and this worked!

    ReplyDelete
  7. Anonymous20 June 2012 at 04:03

    Thanks alot, it work out
    It was putting breakpoints in every code block, but it did not hit any of them

    Great Post

    ReplyDelete
  8. Anonymous22 June 2012 at 00:52

    Thanks a lot. It works

    ReplyDelete
  9. Anonymous24 July 2012 at 12:08

    Thanks so much for posting the solution!

    ReplyDelete
  10. Kyle31 July 2012 at 06:57

    Excellent!! Thanks!

    ReplyDelete
  11. Anonymous7 August 2012 at 22:53

    Thanks a lot for the solution

    ReplyDelete
  12. Anonymous7 December 2012 at 01:35

    Thank

    ReplyDelete
  13. Steve27 December 2012 at 06:34

    Thanks for posting the solution. It explains why a web page that had been working stopped without having been changed.

    ReplyDelete
  14. Anonymous15 January 2013 at 08:55

    Apparently there are many people that have problems with pages that send too many keys, myself included.

    ReplyDelete
  15. Dean16 May 2013 at 07:09

    I'm getting this error on a form that is part of an Intranet SharePoint site. How do I know which web.config file to put this in?

    ReplyDelete
  16. Siderite16 May 2013 at 07:36

    All of them :) And then remove the setting where you think it might be useful to have this new Microsoft behaviour.

    ReplyDelete
  17. Williams Dhanaraj19 June 2013 at 04:00

    Thanks for posting this solution. This is awesome it works fine for me ....gr8 site

    Williams dhanaraj

    ReplyDelete
  18. Simon29 July 2013 at 06:12

    Thank you for the posting. It solves my problem

    ReplyDelete
  19. Anonymous9 September 2013 at 13:00

    Thanks for sharing.

    ReplyDelete
  20. dhkim29 November 2013 at 15:41

    Thank you so~~~ much.

    ReplyDelete
  21. Goutham21 February 2014 at 11:12

    Awesome. You made my day. Thank you very much

    ReplyDelete