损坏的查询字符串：“ 80”被IIS删除了吗？

Question

I've been fighting this problem for a few days now, and can't seem to figure out what is causing it.

I have a registration system that requires activation. An email is sent to the user with a hash that is passed back to the server when they click the activation link. Pretty basic stuff. The link looks something like this:

http://site/activate.aspx?activationKey=26a51d9eba86c73b8f7e800c41bf55453ed3b1c4

While developing on my local machine (running VS2010), this works flawlessly. However, when the site is pushed to the live server (IIS 6), the query string is being mangled, presumably by IIS. Once the query string hits the code-behind, any occurrence of "80" has been stripped away, causing the activation to fail.

I've wondered whether this is an encoding/decoding problem, but none of the characters are special, so I don't think that should be the case.

Answer 1

I know for a fact that IIS does not remove 80 from the querystring by default. I have had it in querystrings many times on my sites without any problems.

Look through the IIS for url-rewrite rules. I'm not sure if the IIS-log will use the final url or the url before IIS. But considering it's 80 I guess someone want to remove port 80 from urls but has added a faulty rewrite rule for this.

So I would look for a place where someone could have tried to strip port 80 from urls. Could be in IIS or upstream.

Answer 2

turn on trace.axd on the website and check what the values are being sent across. Are you sure that the email client is not doing anything

Answer 3

Well, I found the problem. @pst and @Mikael Eliasson were right, some goon did have some some rewrite rules in place, in a sense.

The site is forced into SSL by redirecting a 403;4 error to another (pre-existing) app that rewrites the URL to use HTTPS. In a sense, you can force SSL on an app, and the rest is (broken) magic. Here's the original code:

if ( Request.ServerVariables[ "SERVER_PORT" ] == "80" ) {
    try {
        string queryString, secureURL;

        queryString = Request.Url.AbsoluteUri.ToString();
        queryString = Request.ServerVariables[ "QUERY_STRING" ];
        Response.Write( queryString + "<br>" );

        secureURL = queryString.Replace( "http", "https" );
        secureURL = secureURL.Replace( "403;", "" );
        secureURL = secureURL.Replace( "80", "" );

        Response.Write( secureURL );
        Response.Redirect( secureURL );
    }
    catch ( Exception ex ) {
    }
}

Note the brutal replacement of "80" in there. Changing that replacement to ":80" fixes the problem, assuming I don't pass a query string with ":80" in it, which I won't.

Thanks for at least pointing me in the right direction, guys.