IIS7.5 400 Bad request when a URL includes character :

Question

I am using ARR and ISAPI with IIS7.5. Whenever forwarding URL including specific character : 400 Bad request occurs. How can I solve it?

I guess there is no problem in ARR and ISAPI because no problem in development server(same Env as operating server) it only occurs in operating server.

Answer 1

The : character is only permitted in URLs as part of an IPv6 address. Either encode it as %3A, or don't use it.

You can find the reference in RFC3986

Answer 2

By default IIS 7.5 rejecects certain characters in the path -- the default is the follwing comma separated list: <,>,*,%,&,:,\\. If a request hits that list it will return a http 400 error as the request is bad insofar as the server is configured. See this blog post and this MSDN page for a little background. Specifically, you'll likely want to update the httpRuntime configuration to something like:

<httpRuntime requestValidationMode="2.0"
             requestPathInvalidCharacters="&lt;,&gt;,*,%,&amp;,\"
             />