HTTP Error 404.11 – Not Found: The request filtering module is configured to deny a request that contains a double escape sequence.

확인 범위

이 문서는 화면 또는 로그에 표시된 HTTP Error 404.11 – Not Found: The request filtering module is configured to deny a request that contains a double escape sequence. 문구가 Microsoft 공식 원문의 항목과 일치하는지 확인합니다.

원문 발췌

the OnAuthenticate event. Workaround A. Change your application to not use the WindowsAuthentication_OnAuthenticate method. Instead, implement an IHttpModule that runs in PostAuthenticateRequest, and inspects HttpContext.User. Request limits and URL processing The following changes result due to additional restrictions on how IIS processes incoming requests and their URLs. 11. Request URLs containing unencoded "+" characters in the path (not querystring) is rejected by default You will receive HTTP Error 404.11 – Not Found: The request filtering module is configured to deny a request that contains a double escape sequence. This error occurs because IIS is by default configured to reject attempts to doubly-encode a URL, which commonly represent an attempt to execute a canonicalization attack. Workaround A. Applications that require the use of the "+" character in the URL path can disable this validation by setting the allowDoubleEscaping attribute in the system.webServer/security/requestFiltering configuration section in the application's web.config. However, this may make your application more vulnerable to malicious URLs: <system.webServer> </system.webServer> 12. Requests with querystrings larger then 2048 bytes will be rejected by default You will receive an HTTP Error 404.15 – Not Found: The request filtering module is configured to deny a request where the query string is too long. IIS by default is configured to reject querystrings longer than 2048 bytes. This may affect your application if it uses large querystrings or uses cookieless ASP.NET features like Forms Authentication and others that cumulatively exceed the configured limit on the querystring size. Note This breaking change applies to both Classic and Integrated modes. Workaround A. Increase the maximum querystring size by setting the maxQueryString attribute on the requestLimits element in the system.webServer/security/requestFiltering configuration section in your application's web.config: <system.webServer> </system.webServer> Changes in response header processing These changes affect how response headers are generated by the application. 13. IIS always rejects new lines in response headers (even if ASP.NET enableHeaderChecking is set to false) If your application writes headers with line breaks (any combination of \r, or \n), you will receive an ASP.NET 500 – Server Error: Value does not fall within the expected range. IIS will always reject any attempt to produce response headers with line breaks, even if ASP.NET's enableHeaderChecking behavior is disabled. This is done to prevent header splitting attacks. Note This breaking change applies to both Classic and Integrated modes. 14. When the response is empty, the Content-Type header is not suppressed If the application sets a Content-Type header, it will remain present even if the response is cleared. Requests to ASP.NET content types will typically have the "Content-Typ

확인 절차

1. 현재 화면 또는 로그에서 HTTP Error 404.11 – Not Found: The request filtering module is configured to deny a request that contains a double escape sequence. 문구를 확인합니다.
2. 위 원문 발췌와 문구를 비교합니다.
3. 문구가 일치하면 이 문서의 출처 링크에서 적용 환경과 원문 전체를 확인합니다.

주의

이 문서는 문구 식별 범위로 제한합니다. 출처가 직접 설명하지 않는 원인, 설정 변경, 권한 변경 또는 복구 절차를 이 문서만으로 실행하지 마십시오.