URL中的％09导致IIS(HTTP.SYS?)立即返回HTTP 400 [英] %09 in a URL causes IIS (HTTP.SYS?) to return HTTP 400 immediately

问题描述

我发现，遇到任何包含不是查询字符串一部分的％09 的URL时，IIS7、7.5和8(可能还有以前的版本)都会快速失败.

I've discovered that IIS7, 7.5 and 8 (and probably previous versions too) will fail-fast when encountering any URL that contains %09 that is not part of a querystring.

StackOverflow本身也表现出相同的行为，请注意:

StackOverflow itself exhibits the same behavior, observe:

http://www.stackoverflow.com/questions/%09

这对我的应用程序来说很烦人，因为我构建了一个Web服务，该服务应为每个请求(甚至是无效请求)返回 text/xml ，其中包含包含错误代码的特定XML文档格式.我发现某些Web服务客户端将％09 (通常是由用户复制和粘贴引起的)传递给我的服务，但是我的服务器返回了一个难看的HTML响应，该响应似乎已硬编码到HTTP.SYS中.(我覆盖了IIS中的HTTP 400错误响应，但没有效果.)

This is annoying for my application because I have built a web-service which should return text/xml for every request, even invalid ones, containing a specific XML document format containing error codes. I've found that some webservice clients pass the %09 (often caused by a user copying and pasting) to my service, but my server returns an ugly HTML response that seems hard-coded into HTTP.SYS (I overrode the HTTP 400 error response in IIS, but it has no effect).

错误请求-无效的URL

Bad Request - Invalid URL

HTTP错误400.请求URL无效.

HTTP Error 400. The request URL is invalid.

对此有任何解决方法或解决方案吗?

Is there any workaround or solution for this?

为进行比较:

• Google正确提供了HTTP 404: https://www.google.com/%09
• Apache似乎让MediaWiki处理该错误: http://en.wikipedia.org/wiki/Foo％09
• IIS没有: http://microsoft.com/download/%09

推荐答案

我发现 Http.sys注册表设置文档和 HKEY_LOCAL_MACHINE \ System \ CurrentControlSet \ Services \ HTTP \ Parameters 中的 AllowRestrictedChars 注册表项.我已经确认将其设置为 1 可以使请求通过HTTP.SYS传递而不会立即被拒绝.IIS然后发回其自己的400页，但至少它到达IIS并出现在IIS日志中.此时，可能可以进一步处理应用自定义错误页面的请求.

I found this other question which pointed me towards the Http.sys registry settings for Windows documentation and the AllowRestrictedChars registry key in HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\HTTP\Parameters. I've confirmed that setting this to 1 allows the request to pass through HTTP.SYS without being immediately rejected. IIS then sends back its own 400 page, but at least it reaches IIS and appears in the IIS logs. It may be possible to work further with the request to apply custom error pages and such at that point.

这篇关于URL中的％09导致IIS(HTTP.SYS?)立即返回HTTP 400的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！