7

I have Request Filtering enabled in my IIS 7.5 and want to keep it that way, however, one site is basically just a proxy for some internal Java application and I'd like to disable Request Filtering for that site. Is it possible to do that?

2 Answers 2

5

You could enable Request Filtering for the top (server) level, and then just add a <clear /> in the individual sections in the web.config file for the site for which you don't want to use Request Filtering:

<configuration>
   <system.webServer>
      <security>
         <requestFiltering>
            <denyUrlSequences>
               <clear />
            </denyUrlSequences>
            <fileExtensions allowUnlisted="true">
               <clear />
            </fileExtensions>
         </requestFiltering>
      </security>
   </system.webServer>
</configuration>
2
  • 1
    That is better than removing the rules one by one but still leaves request filtering active, i.e. you could see errors due to double escaping settings etc. I'd rather completely disable it to prevent any possible issues, is it doable? Feb 14, 2012 at 0:51
  • Also add <hiddenSegments><clear /></hiddenSegments> to clear it completely. I had to do this to do a reverse proxy of OpenGrok serving .config files for example.
    – Wolf5
    Jan 16, 2017 at 15:18
0

I'm surprised to see no answer to this here since 2012. There is indeed provision in IIS for removing a filter, but sadly not using the IIS UI (even in 2019 as I write). Instead, it can be done easily by carefully editing the site's web.config (or creating one if needed).

Briefly, a filter can be removed by modifying any isapiFilters element you may find (or by adding one if needed, see below), and then adding a single line "remove" element, naming the filter you want to remove,. Beware the filter name is case-sensitive.

Assuming you have a web.config with no isapiFilters elements already, you could add these lines to the file (again, pay attention to case of all three lines if you type rather than copy/paste), which would remove a filter named Bob:

<isapiFilters>
    <remove name="Bob" />
</isapiFilters>

This would be found or placed one level inside of the system.webServer element, like is shown in the other answer here.

For some readers, that may be all they need to hear. Others could use more elaboration, and I hope to cover that in a blog post, whose link I'd come back here and add when I do it, including covering: all the lines needed if you have no web.config, what errors you may hit in trying this, and tips on implementing a change like this more safely.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.