Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an IIS7 server that acts as a reverse proxy for several other web servers. The other servers run on different ports, so the IIS7 server provides 'friendly URLs' and all on port 80. URL rewriting is used to hand the request off to the back-end server.

One such server is TeamCity (continuous integration and build server). This server provides a way to download the results of a build ('build artifacts'). Typically these artifacts are a zip archive. Here's an example URL:

http://build.teamserver.tigranetworks.co.uk/repository/download/bt25/4164:id/ASCOM+Telescope+Driver+for+AWR+6.0.40.825.zip

The + characters in ASCOM+Telescope+Driver+for+AWR+6.0.40.825.zip are actually spaces in the final filename; the TeamCity server puts in the + characters.

When this link is clicked, I receive the following error from the IIS7 server:

404 - File or directory not found.

The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.

The actual URL appearing in the IIS7 logfile is:

/repository/download/bt25/4164:id/ASCOM+Telescope+Driver+for+AWR+6.0.40.825.zip

The rewrite rule matches the pattern (.*) and rewrites the URL using

http://localhost:8022/{R:1}

Now here is the interesting thing. If I go back to my browser and edit out those + characters, carefully replacing them with spaces, then the URL works!

I conclude that the URL rewriting is somehow not working for those + characters. Is this a known issue? Any suggestions?

share|improve this question
add comment

2 Answers

up vote 3 down vote accepted

The '+' symbol is really not valid URL encoding for a space. TeamCity should be encoding them as %20.

Either way, the error is probably a result of a common requestFiltering security setting in IIS7.

Try the following command:

%windir%\system32\inetsrv\appcmd set config /section:requestfiltering /allowdoubleescaping:true

It should stop IIS from returing 404's for anything with a + in the URL.

share|improve this answer
    
That did the trick, many thanks. BTW, it's not just TeamCity that has that behaviour, it seems to be an Apache thing. Other affected servers include Atlassian stuff (specifically Jira, we were unable to access file attachments with spaces in the filenames and Fisheye diffs were not working correctly). –  Tim Long Jul 25 '11 at 13:53
add comment

As h0tw1r3 already answered, you have to disable URL validation.

If you want to do it on IIS server level then use the command below:

%windir%\system32\inetsrv\appcmd set config /section:requestfiltering /allowdoubleescaping:true

If you want to disable it only on application level, then you need to just add the following section to your web.config file:

<system.webServer>
    <security>
        <requestFiltering allowDoubleEscaping="true" />
    </security>
</system.webServer>
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.