where/When/Why FormDigest Control: SharePoint

FormDigest Control:

Every SharePoint developer should know about the “FormDigest” control. Especially who are developing master pages, site pages and application pages?

I am going to cover in which areas FormDigest control use:

1. What is FormDigest Control?
2. Why every master page should have “FormDigest” control and what is the need?
3. The security validation for this page is invalid?
4. When/where/why use "AllowUnsafeUpdates" in SharePoint?
5. How to do manipulation to the SharePoint data programmatically?

What is FormDigest control?

A FormDigest control has to be included to create a digest for security validations when performing some modifications to SharePoint data. It adds a security token inside your page based on user, site and time. Once the page is posted back the security token is validated. Once the security token is generated it’s valid for a configurable amount of time. 

The security validation for this page is invalid: SharePoint

Scenario:

You have created a new ASPX page and trying to run it under SharePoint context. If the page Post back you get the following error “The security validation for this page is invalid.”
Reason: SharePoint uses Form validation digest to stop attacks.

Where the SharePoint team used/placed the “FormDigest” control? 

By default, default.master [v4.master in SharePoint 2010] has a “FormDigest” control. Need of it is to prevent pages from the cross-site scripting attacks. Refer to get more details here.

The Reason is we can’t do manipulations directly to the SharePoint data because of security validation in SharePoint.

When/where/why use "AllowUnsafeUpdates" in SharePoint?

As per msdn article “AllowUnsafeUpdates is set to true when you are trying to update the database as a result of the GET request”. 

E.g. Say you have a list and you want to update something to the SharePoint data [content DB], then you need to set AllowUnsafeUpdates = true for the web and after you have done you need to set it back to false. 

What will happen if you set as AllowUnsafeUpdates to false? And what is preventing it from cross site scripting attacks?  Yes, the FormDigest control is taking care of all about it. I have already explained about “FormDigest’ control in previous post. Please go through to get more on it here. 

To GET the content from the content DB, we need to set the AllowUnsafeUpdates = true. 
To POST the content to the content DB, not require to set the AllowUnsafeUpdates = true. why means because of "FormDigest" control placed in every master page.