CODEWITHSUNDEEP
asp.netiis-7.5
sleyhane
sleyhane

Reputation: 81

IIS redirect mangling URL parameter value occasionally

We have a multi-tenant application with a Web server in the following environment:

We have some convenience redirects in place in the site's Web.config file. For one of the redirects, the URL parameter value is being mangled occassionally (< 1%) on the request immediately following the 301 redirect.

The rule is intended to redirect URLs such as https://www.myapp.com/some_client_id/notifications to https://www.myapp.com/lms/profile/notifications.aspx?cid=some_client_id

Here is its definition:

<rule name="Redirect profile notifications page" stopProcessing="true">
    <match url="^([^/]+)/notifications/?$" />
    <conditions>
        <add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" />
        <add input="{REQUEST_FILENAME}" matchType="IsDirectory" negate="true" />
    </conditions>
    <action type="Redirect" url="lms/profile/notifications.aspx?cid={R:1}" />
</rule>

Looking at the WWW logs, I see something along the lines of:

2014-07-03 09:40:19 W3SVC2 a.b.c.d GET /some_client_id/notifications - 443 - w.x.y.z Mozilla/5.0+(compatible;+MSIE+9.0;+Windows+NT+6.1;+WOW64;+Trident/5.0) - - www.myapp.com 301 0 0 581 297 156
2014-07-03 09:40:19 W3SVC2 a.b.c.d GET /lms/profile/notifications.aspx cid=mang_ledch_rs 443 - w.x.y.z Mozilla/5.0+(compatible;+MSIE+9.0;+Windows+NT+6.1;+WOW64;+Trident/5.0) - - www.myapp.com 302 0 0 693 277 109
2014-07-03 09:40:19 W3SVC2 a.b.c.d GET /lms/login.aspx ReturnUrl=%2flms%2fprofile%2fnotifications.aspx%3fcid%3dmang_ledch_rs&cid=mang_ledch_rs 443 - w.x.y.z Mozilla/5.0+(compatible;+MSIE+9.0;+Windows+NT+6.1;+WOW64;+Trident/5.0) - - www.myapp.com 200 0 0 7173 336 218

When the client ID value is mangled, it:

I'm not able to reproduce the issue but it happens a few times a day. Using Fiddler, I don't see anything out of the ordinary when making similar requests.

Any ideas on what is causing this? If not, do you have suggestions for how to debug this? Thanks.

Upvotes: 1

Views: 283

Answers (1)

sleyhane
sleyhane

Reputation: 81

I am confident that this issue is the result of email link-checking software that is using ROT13 encryption on link parameter values to avoid performing actions, such as unsubscribing.

Upvotes: 1

Related Questions