CODEWITHSUNDEEP
asp.netiisasp.net-web-apiroutes
David Turner
David Turner

Reputation: 153

Pipe Character in ASP.NET route parameter causing 404

We have a ASP.NET Web API method with the following route:

[System.Web.Http.Route( "api/MergeFields/{id}" )]
public virtual string Get( string id )
{
    ...
}

On most of our servers, if the {id} parameter in the url contains a pipe character, it will still match the route: http://www.example.com/api/MergeFields/Global|Test. However, we have one IIS server where this is returning a 404 error.

Encoding the pipe character does not help: http://www.example.com/api/MergeFields/GlobalAttribute%7CTest, it still returns a 404.

On that same server any other characters in the {id} parameter work fine. For example http://www.example.com/api/MergeFields/GlobalAttribute_Test works.

I have searched for anything in the web.config that might be affecting how a pipe character is interpreted by IIS or ASP.NET but have not been able to find anything. Again, it's just one server that is having this issue. On all our other installations the pipe character works fine and matches that route.

Upvotes: 4

Views: 472

Answers (1)

Large
Large

Reputation: 737

I am unable to comment, but I give it a shot as a solution.
Please let me know if it does not work.

Check the HttpRuntimeSection.RelaxedUrlToFileSystemMapping Property, it could be the issue.

Under your web.config you probably should set it up like this (.NET 4.0):

<system.web>
   <httpRuntime requestValidationMode="2.0" relaxedUrlToFileSystemMapping="true"/>
</system.web>

I don't know about your enviroment, but I assume that you use 4.0.

Edit2:
Also read about the Request filtering (the service that probably is blocking the request). Good information and possible several other verbs you can use to "whitelist" your pipe character: https://learn.microsoft.com/en-us/iis/configuration/system.webserver/security/requestfiltering/

Edit:
FYI, the pipe is defined as a "unsafe character". I recommend to read this document regarding selection of separator characters: https://sites.google.com/site/getsnippet/javascript/ut/url-encoded-characters/-please-stop-using-unsafe-characters-in-urls

Upvotes: 2

Related Questions