We have a C# MVC application that contains a call to an endpoint that is formatted like this
VerifyMe/12345/Password:Reset
On 2 servers, both with no Request Filtering set and our application having no web.config entry for httpRuntime requestPathInvalidCharacters, one server (IIS 10) is allowing the request through and one server (IIS 8) is returning a 400 Bad Request (due to the colon)
I cannot find anywhere that talks about the valid characters changing between the 2 versions
Is there anything else that could be making the IIS 8 server return a 400 for that URL?
The root cause of the problem is the colon, which on Windows (and DOS) based systems is a reserved character for file structures and can give you all kinds of problems.
It seems that ASP.net doesn't allow a colon before "?", even though it is encoded as %3A in the URL. You can refer to this thread.
Related
I have an ASP.Net Core API that works great while running in Visual Studio. I am able to perform all actions successfully. However, now that I have deployed it to a Win 2008 R2 server, using IIS as reverse proxy, no page resolves. I always get a 404 page not found error. Actually, if I add a default get method returning value array, like what is provided by default when creating a new controller, it always returns. I do not understand what the issue is.
With the given information, I suspect only one thing, is that your server is not allowing HTTP Methods, or at least the OPTIONS one(for the preflight request).
To remediate to that, check out the UrlScan.ini config file in your server located at the below path:
C:\Windows\System32\inetsrv\urlscan
Open the file, and go to [AllowVerbs] section, it should be as the following(Add OPTIONS if it's not there):
[AllowVerbs]
;
; The verbs (aka HTTP methods) listed here are those commonly
; processed by a typical IIS server.
;
; Note that these entries are effective if "UseAllowVerbs=1"
; is set in the [Options] section above.
;
GET
HEAD
POST
OPTIONS
Hope you'll find this useful
We are getting a 405 error and the following exception from IIS7 when attempting to apply a ResponseStreamFilter to HttpResponse.Filter:
HttpException:
The HTTP verb POST used to access path '/app/Thing.asmx/Command' is not allowed.
We are applying the filter by using an HttpModule with code like this:
var rfs = new ResponseFilterStream(HttpContext.Current.Response.Filter);
rfs.TransformStream +=
new Func<System.IO.MemoryStream, System.IO.MemoryStream>(ProcessStream);
HttpContext.Current.Response.Filter = rfs;
Log("Response stream filter applied correctly.");
All of the code in our HttpModule works just fine... it's all wrapped in a try-catch just to be safe and isn't throwing any exceptions, and diagnostic logging like the last line above is working correctly.
But it looks like our ProcessStream method in the above code is never being called. If we apply the filter to HttpResponse.Filter at all, IIS throws the 405 exception before our filter begins processing.
Our code has worked before on several similar systems, so we suspect IIS/machine configuration on this specific server is responsible. What could be causing this?
The most commonly reported cause for a 405 error in a situation like this seems to be using Url.Rewrite. (The HTTP verb POST used to access path '/test.html' is not allowed) However, we are never using a Url.Rewrite.
Another commonly reported cause is trailing slashes in the request URL. (HTTP 405 on Error on HTTP POST IIS ASP .NET) But as mentioned above, the URL being requested does not end with a slash.
The app pool is running .NET 4.0 in a Classic pipeline (jQuery AJAX post receives 405 error (HTTP verb POST not allowed)), but our code has run without issue on many other systems under a Classic app pool, so there would still have to be something unique to this server's configuration. Changing to Integrated pipeline breaks the application our code is filtering, so that's not a possible workaround anyway.
Turns out, it was a very obscure IIS bug:
http://support.microsoft.com/kb/980368
The ExtensionlessUrl handler (*.) was incorrectly getting involved with the request instead of just the WebServiceHandlerFactory (*.asmx) as expected. The workaround was:
Manually deleting the ExtensionlessUrl handler entries from the web application's handler mappings
Manually moving the ExtensionlessUrl handler entries under anything you actually expect to be hit
Adding a web.config entry under system.webServer/handlers to remove the ExtensionslessUrl handler as needed (we went with this option to make sure it got included with app demployment)
We had to burn a Microsoft support ticket on this one, since there's no way we would have figured this out in any reasonable timeframe. Hopefully this helps someone else.
I have a shared Windows hosting account with IIS7.5 and Plesk 10.4 .
Now, when I try to visit every page, an aspx page, some php pages, or even a jpg file, it shows This error:
Server Error
500 - Internal server error. There is a problem with the resource you
are looking for, and it cannot be displayed.
This is last lines of log file: (which plesk shows for me)
2012-03-01 18:25:59 W3SVC100 H105 208.67.23.51 GET /15iya/31.jpg - 80
109.162.226.165 HTTP/1.1 Mozilla/5.0+(Windows+NT+6.2;+WOW64)+AppleWebKit/535.7+(KHTML,+like+Gecko)+Chrome/16.0.912.63+Safari/535.7 jsuid=1735775291;+_cfduid=dcb02ca5c638c5a33cf10003ae6ac2c561326405625;+_utma=117785567.65259312.1326369096.1330372520.1330376628.15;+_utmz=117785567.1327165762.11.5.utmcsr=2barnamenevis.com|utmccn=(referral)|utmcmd=referral|utmcct=/
ghiasi.net 500 19 13 1380 627 531 2012-03-01 18:26:13 W3SVC100 H105 208.67.23.51 GET / - 80 - 109.162.226.165 HTTP/1.1 Mozilla/5.0+(Windows+NT+6.2;+WOW64)+AppleWebKit/535.7+(KHTML,+like+Gecko)+Chrome/16.0.912.63+Safari/535.7 jsuid=1735775291;+_cfduid=dcb02ca5c638c5a33cf10003ae6ac2c561326405625;+_utma=117785567.65259312.1326369096.1330372520.1330376628.15;+_utmz=117785567.1327165762.11.5.utmcsr=2barnamenevis.com|utmccn=(referral)|utmcmd=referral|utmcct=/
ghiasi.net 500 19 13 1380 615 515
try check with your asp.net version enable properly in plesk
https://www.motherhost.com/help/plesk-windows-hosting/iis-shows-500-internal-server-error-on-everything/
To configure ASP.NET Settings for a site:
If you are subscribed to several hosting packages and have access to several webspaces associated with your account, in the Subscription menu at the top of the screen, select the required webspace.
Go to the Websites & Domains tab and click your website's domain name.
Click ASP.NET Settings.
Set up the strings that determine database connection data for ASP.NET applications that use databases. This option is available only for ASP.NET 2.0.x.
When you open the ASP.NET configuration screen for the first time, sample connection parameters with common constructions are displayed. You can delete them and specify your own strings.
To add a string, enter the required data into the Name and Connection Parameters input fields and click next to them.
To remove a string, click next to it.
Set up custom error messages that will be returned by ASP.NET applications in the Custom Error Settings field:
To set the custom error messages mode, select an appropriate option from the Custom error mode menu:
On - custom error messages are enabled.
Off - custom error messages are disabled and detailed errors are to be shown.
RemoteOnly - custom error messages are displayed only to remote clients, and ASP.NET errors are shown to the local host users.
To add a new custom error message (which will be applied unless the Off mode was selected), enter the values in the Status Code and Redirect URL fields, and click .
Status Code defines the HTTP status code resulting in redirection to the error page.
Redirect URL defines the web address of the error page presenting information about the error to the client.
Due to possible conflicts, you cannot add a new custom error message with an error code that already exists, but you can redefine the URL for the existing code.
To remove a custom error message from the list, click next to it.
Configure compilation settings in the Compilation and Debugging field:
To determine the programming language to be used as default in dynamic compilation files, choose an entry from Default web page language list.
To enable compiling retail binaries, leave the Switch on debugging checkbox empty.
To enable compiling debug binaries, select the Switch on debugging checkbox. In this case, the source code fragments containing error will be shown in a diagnostic page message.
Note. When running applications in debug mode, a memory and/or performance overhead occurs. It is recommended to use debugging when testing an application and to disable it before deploying the application into production scenario.
Configure encoding settings for ASP.NET applications in the Globalization Settings section:
To set an adopted encoding of all incoming requests, enter an encoding value into the Request encoding field (default is utf-8).
To set an adopted encoding of all responses, enter an encoding value into the Response encoding field (default is utf-8).
To set an encoding which must be used by default for parsing of .aspx, .asmx, and .asax files, enter an encoding value into the File encoding field (default is Windows-1252).
To set a culture which must be used by default for processing incoming web requests, select an appropriate item from the Culture list.
To set a culture which must be used by default when processing searches for a locale-dependent resource, select an appropriate item from the UI Culture list.
Set a code access security trust level for ASP.NET applications in the Code Access Security field.
CAS trust level is a security zone to which applications execution is assigned, defining what server resources the applications will have access to.
Important: When an assembly is assigned a trust level that is too low, it does not function correctly. For more information on the permissions levels see http://msdn.microsoft.com/library/en-us/dnnetsec/html/THCMCh09.asp?frame=true#c09618429_010.
Enable the usage of the auxiliary scripts in the Script Library Settings field. Specifying the script library settings is necessary if the validation web controls are used on your web site. This option is available only for ASP.NET 1.1.x.
If you need to use auxiliary scripts (specifically, scripts implementing objects for validating input data), provide the settings for .NET framework script library. To do so, enter the path beginning with the domain root directory preceded by the forward slash into the Path to Microsoft script library field, or click the folder icon next to the Path to Microsoft script library field and browse for the required location.
To initiate the auto-installation of files containing the scripts to the specified location, select the Install checkbox. If the files already exist there, they will be rewritten.
Set client session parameters in the Session Settings field:
To set up the default authentication mode for applications, select an appropriate item from the Authentication mode list. Windows authentication mode should be selected if any form of IIS authentication is used.
To set up time that a session can remain idle, type the number of minutes into the Session timeout box.
Click OK to apply all changes.
windows hosting india
I have a problem running a Java (using Metro) client against a .NET STS and secured web service. However, when I run my .NET based client, it always works.
As you probably already know, when a JAX-WS client is ran, it requests metadata from the service during runtime (even though it already has ran wsimport during design time). However, it seems that this runtime metadata request is where my problem is.
The problem that I'm facing is that during the runtime requests of metadata, some WSDL's exported by my WCF service caused the Java client to just 'hang' during the mex requests. When it hangs, it doesn't even get to the point of issuing the RST request.
For example, I can get to a spot where I have 9 [OperationContract] attributes and it works. But when I add a 10th service method, it doesn't work. However, if I remove one of the 9, then it works. I know there isn't a problem with a particular method because I can mix and match and the same pattern holds.
I can't seem to deduce a pattern or reason for why some WSDL's work and some don't. I strongly doubt there is a limit to the number of service methods. However, could this be a problem with "overall complexity" with the exported WSDL?
Does anyone have any ideas? Have anyone run into this issue before?
If more information is needed, I can glady post it. I'm just trying to keep the initial post a manageable length.
I will also add that I'm running the STS and secured web serivce in .NET 4, and they are based on WIF (so I don't have to worry about security settings). My .NET client is also .NET 4. On the Java side, I'm using Netbeans 6.9.1 with Metro 2.1 running Glassfish 3. I've verified that I receive the same issue running on Metro 2.0.
Please see WSDL Requests with Metro/JAX-WS/WSIT During Runtime for a detailed answer.
Following the example given, there're chances that MaxMessageReceivedSize or MaxStringContentLength limit is reached. Have you tried increasing the values of MaxMessageReceivedSize and MaxStringContentLength for binding? You can try enabling WCF traces, there'd be a warning logged if any such limit is reached.
I have a WCF service that has been working flawlessly for 3 months. It is consumed by local clients on the same server hosting the WCF service and local network clients. It uses SSL and basic authentication for security.
A few nights ago, the local client (local network clients not affected) started receiving 404 errors whenever it tried to use the service. I am able to open a browser on the server hosting the WCF and view the WSDL and even call the "put" command and get the expected "method not allowed". I have confirmed that no software or hardware changes have been made to the hosting server. I have confirmed that the SSL key is valid. I have confirmed that the permissions for the Application Pool are sufficient. I have confirmed that no firewall is running. The only thing odd is the IIS log showing that the first post does not contain the basic authentication user. However, the next line in the log does and shows a 200 response. I am not entirely sure that log is not normal. See below. I was hoping somebody could give me another place to research to find the problem. Please let me know.
2010-08-28 10:30:03 192.168.100.100 POST /protected/Service_Name_Here.svc/put - 443 - 192.168.100.100 - 401 2 5 2
2010-08-28 10:30:03 192.168.100.100 POST /protected/Service_Name_Here.svc/put - 443 User_Name_Here 192.168.100.100 - 200 0 0 5
EDIT: The local client that is throwing the error is transferring large files to the WCF service. The local network clients are transferring small files and not throwing the error. I found this link that suggests that the default transferMode="Buffered" will throw a 404 for files above 20 MB file. The fix for this person was to change the transferMode="Streamed". However, the "Streamed" setting only allows 1 parameter to be passed to the WCF service. I have multiple parameters so I need to find a fix for "buffered" mode.
The fix for this person was to change the transferMode="Streamed". However, the "Streamed" setting only allows 1 parameter to be passed to the WCF service. I have multiple parameters so I need to find a fix for "buffered" mode.
Sounds like that's the correct fix, however the caveat is that streamed mode requires custom message contracts; you can't use the "RPC" style that WCF pushes as a default for operations. If you need to provide more than one parameter in a streamed mode transfer, simply add them to your custom message contract.
Here's a nice discussion on the subject from Microsoft.
If you have problems with message size be aware that there are 3 levels of configuring accepted request size for IIS:
WCF - default max message size 65KB (maxReceivedMessageSize)
ASP.NET runtime hosting WCF - default max request size is 4MB (maxRequestLength)
IIS 7 with request filtering installed - default max request size about 28MB (maxAllowedContentLength)
If WCF rejects your message you will probably get meaning full error but for ASP.NET and IIS you will get exactly HTTP 404.
Streaming will not help you unless you change your operations.