AjaxControlToolkit NoBotState is always InvalidBadResponse

Question

I am trying to implement AjaxControlToolkit NoBot but I always get false from IsValid() method (the state value is always InvalidBadResponse). Am I missing something here?

ASCX code:

// buttons, textboxes etc.
<asp:NoBot ID="NoBot1" 
           runat="server"             
           CutoffMaximumInstances="5" 
           CutoffWindowSeconds="60" 
           ResponseMinimumDelaySeconds="2"
           />

Code behind:

protected void Button1_Click(object sender, EventArgs e)
{
    AjaxControlToolkit.NoBotState state;

    if (!NoBot1.IsValid(out state))
    {
        Page page = HttpContext.Current.Handler as Page;
        ScriptManager.RegisterStartupScript(page, page.GetType(), "err_msg", "alert('" + " BOT " + "');", true);
    }
     else
    { ...}
}

Far more weird is this: I enter data for login and click on asp button. NoBot state is InvalidBadResponse and it fails. But, then I click on browser's refresh button it asks me to resend request I say ok and now state is valid! Why?

Asclepiadean

Could you show your authentication code? Does ViewState and SessionState enabled? – Lombardi

Yes everything is enabled. Authentication code is standard membership methods (Validate user, if not Failed login) it works. And that code is in "ELSE" block in my upper code. But first time NotBot1.IsValid state is always InvalidBadResponse. But when I press refresh it is valid. To be worse I have downloaded example code from tutorial page and again same problem. I test this on localhost. – Asclepiadean

Do you use UpdatePanels on a page? If you do, could you show markup? – Lombardi

No I don't use any UpdatePanel. This is custom dotNetNuke module. Dnn use asp scriptManager. I can't change it. Does NoBot require ToolkitScriptManager? – Asclepiadean

looks like there is a mismatch between controlstate value in SessionState and stored in hidden field on the page. Try to put the NoBot control into UpdatePanel with UpdateMode="Alwyas" – Lombardi

I tried that and it doesn't work hmmm... – Asclepiadean

Does this behavior change in different browsers? Specifically the change from Valid to Not Valid after a refresh that you mention at the end. – Bunsen

Were you ever able to figure out the problem here? I've recently had this same thing happen. – Calen

Answer 1

The only reason I know of that you'll get an "InvalidBadResponse" from the NoBot control is if you have javascript disabled in your browser. The documentation page states that one of the techniques used by NoBot is

Forcing the client's browser to perform a configurable JavaScript calculation and verifying the result as part of the postback. (Ex: the calculation may be a simple numeric one, or may also involve the DOM for added assurance that a browser is involved)

An "InvalidBadRespone" message means that the javascript did not get executed (also from the link above):

InvalidBadResponse: An invalid response was provided to the challenge suggesting the challenge script was not run

I would double check your browser settings. I've tested this by disabling javascript in my browser (just to make sure) and trying the example on the documentation page.

You can customize the calculation using the OnGenerateChallengeAndResponse attribute to specify an Event Handler. I good example of implementing one such event handler is this (code credit to this post):

protected void PageNoBot_GenerateChallengeAndResponse(object sender, AjaxControlToolkit.NoBotEventArgs e)
{
    Random r = new
    Random();

    int iFirst = r.Next(100);

    int iSecond = r.Next(100);
    e.ChallengeScript = String.Format("eval('{0}+{1}')", iFirst, iSecond);
    e.RequiredResponse = Convert.ToString(iFirst + iSecond);  
}

Bunsen

Answer 2

Please refer this

http://www.asp.net/ajaxlibrary/AjaxControlToolkitSampleSite/NoBot/NoBot.aspx

http://www.asp.net/ajaxlibrary/HOW%20TO%20Use%20the%20NoBot%20Control.ashx

Eudemonia

Answer 3

As mentioned in other answers, InvalidBadResponse is due to the Javascript challenge failing.

The problem:

The reason it was failing for me was because the ASP.NET ajax libraries needed to run this were failing to load; have a look at your browser's javascript debugger; this is what mine (in Chrome) looked like

As you can see, the .axd files were not being served and the error ASP.NET Ajax client-side framework failed to load error was pretty telling.

The cause: (in my case)

I had an url re-write rule that accidentally altered the .axd urls - causing them not to be served.

I would recommend checking your web.config, if needed adding the line

<add input="{URL}" pattern="\.axd$" negate="true"/>

to your rules and this

routes.Ignore("{resource}.axd/{*pathInfo}");

in your Global.asax (if you have one) where (and if) you register routes.

Check this SO answer out: Ajax client-side framework failed to load Asp.Net 4.0

Allaallah

Answer 4

Another possible cause might be the ViewStateMode of the master, page or control being set to Disabled. Seems that it needs to be Enabled for the NoBot to work properly.

I was doing some tests with ViewStateMode="Disabled" on my CMS's Master page, and NoBotState started to return InvalidBadResponses on my login page. Changing it to ViewStateMode="Enabled" fixed it for me.

Galvan