Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to use the Request Filtering feature in IIS 7.5 to filter out some malevolent requests we are getting from some bots. The requests are triggering "System.Web.HttpException: A potentially dangerous Request.Path value was detected from the client" and I don't want to make a case in our application configuration for it. But adding rules to deny these requests in the Request Filtering feature don't do anything because apparently request validation happens first. Any idea on how to filter these bad requests using IIS before validation happens?

share|improve this question

Based on my experience and using Failed Request Tracing, validation errors against Request.Path take place as soon as any .NET code runs. The Request Tracing module runs as early as the begin request pipeline.

If you have a managed .NET module that is executing during the begin request event (sample below).

using System;
using System.Web;

namespace Test
{
    public sealed class CustomModule : IHttpModule
    {
        public void Dispose()
        {
        }

        public void Init(HttpApplication context)
        {
            context.BeginRequest += context_BeginRequest;
        }

        void context_BeginRequest(object sender, EventArgs e)
        {
            // Main .NET Code Here
        }
    }
}

Please ensure that this module runs after the Request Filtering Module.

  • Using the IIS Manager, click on Modules.
  • Click on View Ordered Lists
  • Ensure that any managed .NET module is placed after the RequestFilteringModule.

This guarantees that the Request Filtering Module runs before any possible .NET code. Hopefully in this scenario, even if a request has an invalid Request.Path value, it should be picked up by the Request Filtering module prior to any visible error.

share|improve this answer
1  
I apologize, I'm new to answering questions. Hopefully it's more readable now. It's more straight to the point, less of the background information that lead me to a possible answer. – milope Mar 16 at 17:28
    
That is much better. The formatting is almost perfect now. I can't comment on the content though, because I don't know anything about .NET. – kasperd Mar 16 at 17:38
    
Well thank you for the feedback. I'm hoping to be active whenever I can on these forums. – milope Mar 16 at 19:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.