I have Request Filtering enabled in my IIS 7.5 and want to keep it that way, however, one site is basically just a proxy for some internal Java application and I'd like to disable Request Filtering for that site. Is it possible to do that?

You could enable Request Filtering for the top (server) level, and then just add a <clear /> in the individual sections in the web.config file for the site for which you don't want to use Request Filtering:

<configuration>
   <system.webServer>
      <security>
         <requestFiltering>
            <denyUrlSequences>
               <clear />
            </denyUrlSequences>
            <fileExtensions allowUnlisted="true">
               <clear />
            </fileExtensions>
         </requestFiltering>
      </security>
   </system.webServer>
</configuration>
  • 1
    That is better than removing the rules one by one but still leaves request filtering active, i.e. you could see errors due to double escaping settings etc. I'd rather completely disable it to prevent any possible issues, is it doable? – Borek Bernard Feb 14 '12 at 0:51
  • Also add <hiddenSegments><clear /></hiddenSegments> to clear it completely. I had to do this to do a reverse proxy of OpenGrok serving .config files for example. – Wolf5 Jan 16 '17 at 15:18

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.