当URL数据中的冒号成为WCF时，其拒绝请求并带有“ 400 Bad Request”

Question

I'm trying something pretty simple using a self hosted WCF service , and I can't believe I've spent half a day just trying to get this to work.

I've got a UriTemplate for the following endpoint.

[WebGet(UriTemplate="{documentName}?catalog={catalog}")]
DocData FindJobInfo(string documentName, string catalog);

And it rejects requests to it with a "400 Bad Request" error when I try to hit it with a URL that has colons in the docuementName parameter. An actual example follows:

http://localhost:59982/dms/:Q9:m:w:x:h:~140410145342551.nev?catalog=test

For those of you who are about to say "UrlEncode it". It also fails with this request:

http://localhost:59982/dms/%3AQ9%3Am%3Aw%3Ax%3Ah%3A~140410145342551.nev?catalog=test

However ... if i replace all the colons with semi colons in the documentName ... it works:

http://localhost:59982/dms/;Q9;m;w;x;h;~140410145342551.nev?catalog=test

What in the world? Also, the first URL format should work just fine because I can hit a vendors site using that same documentName with colons and all and it works fine. I've even tried adding the following to the web.config and it still doesn't work:

<system.web>
  <httpRuntime requestPathInvalidCharacters="" />
  <compilation debug="true" targetFramework="4.0" />
</system.web>

---

EDIT

I've had a response claiming that colons simply aren't valid in the URL, yet I hit vendor endpoints with them just fine. Here is an example:

https://api.site.company.com/v1/Document/:Q9:m:w:x:h:~140410145342551.nev/info

This is an exact REST call with the company name changed for privacy. I have no problems retrieving data from this endpoint. I don't see why they would choose such a crazy looking ID to address their resources. But they did, and it works for them. Why can't I get my endpoints to accept them.

Answer 1

The issue is caused by ASP.NET/IIS settings. As standard, the following characters are not allowed in the URL for some security and mechanism reasons:

• <
• >
• *
• %
• :
• &
• \\

You can either allow all characters, as stated here , or just remove the colon character, like this:

requestPathInvalidCharacters="<,>,*,%,&,\"

You can read furhter information and the risks about this behavior in this article by Scott Hanselman on his blog.