CODEWITHSUNDEEP
asp.net-mvcasp.net-mvc-3asp.net-mvc-routing
robmzd
robmzd

Reputation: 1823

Strange routes shown in logs for MVC3 application

In one of my MVC3 web applications I have recently noticed some strange looking Urls in the analytics reports.

The Urls look like they have an encoded value injected into the route but seem to match the routes as if the encoded value was not there.

Normal Url

/MyWebsite/Controller/Action

Appears in the logs occasionally as

/MyWebsite/(F(B5l-uGhiwA7p6lMmAdzwc27qHH8p5Kdmy5l3ixub7-meZ315Xm-uOtFl_w8RRdki4pf_yhRysEOVZ93xPV3yxDkn5XhXaY5PLara_kiqFb8BlHDZkzqv6wHgOgMTWgUF0))/Controller/Action

I have tested this on the server and local machine and it resolves to the controller regardless of the presence of the inserted value.

They appear to follow a certain pattern so I tested using other variations

/MyWebsite/(F(anything-here))/Controller/Action

Resolves fine, I can also replace the F with any other letter

/MyWebsite/(A(anything-here))/Controller/Action

However, putting more than 1 letter or other character in place of the F does not resolve

/MyWebsite/(AB(anything-here))/Controller/Action = 404 Error

I thought it may be something to do with Cookieless sessions but the information I have found suggests that this isn't supported in MVC anyway. Does anyone know what this is, or if it is anything to worry about?

EDIT:

Turning off cookies for a local browser, I set the session state to 'Auto Detect' in IIS manager and it gave me a key in the URL that looks strikingly similar to the pattern described above.

When I try to actually log in without Cookies it doesn't seem to work, but perhaps that's another issue.

Setting IIS manager to 'Use Cookies' and accessing using a browser with cookies turned off (I used Opera with option 'Never accept cookies' in Advanced preferences) didn't seem to create the URL as before, but judging by the similarities it must at least explain why it matches the routes.

Since IIS is set to 'Use Cookies' on my server, I'm not sure why the URLs are being generated, but at least I now know what they are. Perhaps this is an attempt at Session hijacking...

Upvotes: 2

Views: 144

Answers (1)

Marco Miltenburg
Marco Miltenburg

Reputation: 6138

This does indeed look like session data stored in the URL. It's a feature of ASP.NET and works just fine with MVC as well. Look in the IIS manager for the Session State icon of your website and it's Cookie Settings Mode is most likely set to Auto Detect. This might cause it to fall back to URI mode in case cookies are not supported.

Upvotes: 2

Related Questions