I have an IIS7 server that acts as a reverse proxy for several other web servers. The other servers run on different ports, so the IIS7 server provides 'friendly URLs' and all on port 80. URL rewriting is used to hand the request off to the back-end server.

One such server is TeamCity (continuous integration and build server). This server provides a way to download the results of a build ('build artifacts'). Typically these artifacts are a zip archive. Here's an example URL:


The + characters in ASCOM+Telescope+Driver+for+AWR+ are actually spaces in the final filename; the TeamCity server puts in the + characters.

When this link is clicked, I receive the following error from the IIS7 server:

404 - File or directory not found.

The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.

The actual URL appearing in the IIS7 logfile is:


The rewrite rule matches the pattern (.*) and rewrites the URL using


Now here is the interesting thing. If I go back to my browser and edit out those + characters, carefully replacing them with spaces, then the URL works!

I conclude that the URL rewriting is somehow not working for those + characters. Is this a known issue? Any suggestions?


The '+' symbol is really not valid URL encoding for a space. TeamCity should be encoding them as %20.

Either way, the error is probably a result of a common requestFiltering security setting in IIS7.

Try the following command:

%windir%\system32\inetsrv\appcmd set config /section:requestfiltering /allowdoubleescaping:true

It should stop IIS from returing 404's for anything with a + in the URL.

  • That did the trick, many thanks. BTW, it's not just TeamCity that has that behaviour, it seems to be an Apache thing. Other affected servers include Atlassian stuff (specifically Jira, we were unable to access file attachments with spaces in the filenames and Fisheye diffs were not working correctly). – Tim Long Jul 25 '11 at 13:53
  • Hi @TimLong, I am experiencing exactly the same issue, however this answer has not solved it in my case. When I change this setting, the response changes from an IIS response to an Apache response! – Matt Canty Sep 13 '17 at 14:32

As h0tw1r3 already answered, you have to disable URL validation.

If you want to do it on IIS server level then use the command below:

%windir%\system32\inetsrv\appcmd set config /section:requestfiltering /allowdoubleescaping:true

If you want to disable it only on application level, then you need to just add the following section to your web.config file:

        <requestFiltering allowDoubleEscaping="true" />
  • 1
    Nah, doesn't work( – abatishchev Sep 23 '14 at 21:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.