'+' symbol problem in URL in IIS 7.x

Question

We are sending an HTML encoded string in the Query string. It was working fine on IIS 6 (windows 2003). We have recently moved the website to Windows 2008 (IIS 7.x). Since the move any Query String that contains "+" sign i.e., "%2b" gives error on the server "404 - File or directory not found."

Any help?

Best regards.

Solution 1

The reason why you are facing this error is that IIS7 has introduced new URL filtering rules for security reasons. So '+' sign is blocked by default as part of security reason in URL.

To resolve this issue you have to set allowDoubleEscaping="true" in web.config files. Here is the tag to do that.

<system.webServer>
<security>
  <requestFiltering allowDoubleEscaping="true">
  </requestFiltering>
</security>

Solution 2

You can change the + to %20 when encoding to handle this programmatically, assuming that you have control over the code that's producing the urls.

Comments

[Guffa]

The encoded + is the same as the encoded %20, but the unencoded + that is encoded as %2b is not the same.

[Jamie Treworgy]

Perhaps I misunderstood the question - I thought the problem was IIS not handling + as a space. If he actually has a plus sign as part of a file URL then it would have to be encoded as %2b (and hence should have worked anyway) since + means space in a query string.