I want to use the Request Filtering feature in IIS 7.5 to filter out some malevolent requests we are getting from some bots. The requests are triggering "System.Web.HttpException: A potentially dangerous Request.Path value was detected from the client" and I don't want to make a case in our application configuration for it. But adding rules to deny these requests in the Request Filtering feature don't do anything because apparently request validation happens first. Any idea on how to filter these bad requests using IIS before validation happens?
Based on my experience and using Failed Request Tracing, validation errors against Request.Path take place as soon as any .NET code runs. The Request Tracing module runs as early as the begin request pipeline.
If you have a managed .NET module that is executing during the begin request event (sample below).
Please ensure that this module runs after the Request Filtering Module.
This guarantees that the Request Filtering Module runs before any possible .NET code. Hopefully in this scenario, even if a request has an invalid Request.Path value, it should be picked up by the Request Filtering module prior to any visible error.