Title: AspNetCoreModule is ignoring request validation hints during redirection · Issue #250 · aspnet/AspNetCoreModule · GitHub
Open Graph Title: AspNetCoreModule is ignoring request validation hints during redirection · Issue #250 · aspnet/AspNetCoreModule
X Title: AspNetCoreModule is ignoring request validation hints during redirection · Issue #250 · aspnet/AspNetCoreModule
Description: I am using the .NET Core Redirection Module to forward some external traffic to an internal URL. The logs on the IIS reverse proxy site appear fine. info: Microsoft.AspNetCore.Hosting.Internal.WebHost[1] Request starting HTTP/1.1 POST ht...
Open Graph Description: I am using the .NET Core Redirection Module to forward some external traffic to an internal URL. The logs on the IIS reverse proxy site appear fine. info: Microsoft.AspNetCore.Hosting.Internal.WebH...
X Description: I am using the .NET Core Redirection Module to forward some external traffic to an internal URL. The logs on the IIS reverse proxy site appear fine. info: Microsoft.AspNetCore.Hosting.Internal.WebH...
Opengraph URL: https://github.com/aspnet/AspNetCoreModule/issues/250
X: @github
Domain: github.com
{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"AspNetCoreModule is ignoring request validation hints during redirection","articleBody":"I am using the .NET Core Redirection Module to forward some external traffic to an internal URL.\r\n\r\nThe logs on the IIS reverse proxy site appear fine.\r\n\r\n```\r\ninfo: Microsoft.AspNetCore.Hosting.Internal.WebHost[1]\r\n Request starting HTTP/1.1 POST http://localhost/SiteWithReverseProxy/OldUrl text/xml 545\r\ninfo: Microsoft.AspNetCore.Rewrite.RewriteMiddleware[9]\r\n Request was redirected to http://localhost:9999/NewUrl\r\n```\r\n\r\nThis results, I think understandably, in a validation rejection, due to the port delimiter:\r\n\r\n`A potentially dangerous Request.Path value was detected from the client (:)`\r\n\r\nHowever, I cannot get the AspNetCoreModule to respect `web.config` changes to validation policy.\r\n\r\nWorth noting that the ported destination is running in-process and otherwise responsive.\r\n\r\nThis is my proxy `web.config`, with the usual cabal of validation changes:\r\n\r\n```xml\r\n\u003c?xml version=\"1.0\" encoding=\"utf-8\"?\u003e\r\n\u003cconfiguration\u003e\r\n \u003csystem.web\u003e\r\n \u003cpages validateRequest=\"false\" /\u003e\r\n \u003chttpRuntime requestValidationMode=\"2.0\" relaxedUrlToFileSystemMapping=\"true\" requestPathInvalidCharacters=\"\" /\u003e\r\n \u003c/system.web\u003e\r\n \u003csystem.webServer\u003e\r\n \u003chandlers\u003e\r\n \u003cadd name=\"aspNetCore\" path=\"*\" verb=\"*\" modules=\"AspNetCoreModule\" resourceType=\"Unspecified\" /\u003e\r\n \u003c/handlers\u003e\r\n \u003caspNetCore processPath=\"%LAUNCHER_PATH%\" arguments=\"%LAUNCHER_ARGS%\" forwardWindowsAuthToken=\"false\" stdoutLogEnabled=\"false\"\u003e\r\n \u003cenvironmentVariables\u003e\r\n \u003cenvironmentVariable name=\"ASPNETCORE_ENVIRONMENT\" value=\"Tokens\" /\u003e\r\n \u003c/environmentVariables\u003e\r\n \u003c/aspNetCore\u003e\r\n \u003c/system.webServer\u003e\r\n\u003c/configuration\u003e\r\n```\r\n\r\n","author":{"url":"https://github.com/danielcrenna","@type":"Person","name":"danielcrenna"},"datePublished":"2017-11-17T05:33:40.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/250/AspNetCoreModule/issues/250"}
| route-pattern | /_view_fragments/issues/show/:user_id/:repository/:id/issue_layout(.:format) |
| route-controller | voltron_issues_fragments |
| route-action | issue_layout |
| fetch-nonce | v2:f03d9dbc-abd9-a69d-e577-6ce5883efa1a |
| current-catalog-service-hash | 81bb79d38c15960b92d99bca9288a9108c7a47b18f2423d0f6438c5b7bcd2114 |
| request-id | 875E:241082:1FE977A:2AEFF11:6A652A95 |
| html-safe-nonce | 5cb494fe674a7b4254ab9ee02ed8c8429b05a493c66c590158428e67b142a0bb |
| visitor-payload | eyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiI4NzVFOjI0MTA4MjoxRkU5NzdBOjJBRUZGMTE6NkE2NTJBOTUiLCJ2aXNpdG9yX2lkIjoiMzA4ODc3MzQxNTQzMDMzNTEyNSIsInJlZ2lvbl9lZGdlIjoiaWFkIiwicmVnaW9uX3JlbmRlciI6ImlhZCJ9 |
| visitor-hmac | 22b6c5af4cfd4f4d892179fb57c8ee71ea034ba4077a9ba3bfe105abb807baef |
| hovercard-subject-tag | issue:274756423 |
| github-keyboard-shortcuts | repository,issues,copilot |
| google-site-verification | Apib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I |
| octolytics-url | https://collector.github.com/github/collect |
| analytics-location | / |
| fb:app_id | 1401488693436528 |
| apple-itunes-app | app-id=1477376905, app-argument=https://github.com/_view_fragments/issues/show/aspnet/AspNetCoreModule/250/issue_layout |
| twitter:image | https://opengraph.githubassets.com/a30363c3629adad3c18ff345667bea65476b75326245b3d065d481807cfd8730/aspnet/AspNetCoreModule/issues/250 |
| twitter:card | summary_large_image |
| og:image | https://opengraph.githubassets.com/a30363c3629adad3c18ff345667bea65476b75326245b3d065d481807cfd8730/aspnet/AspNetCoreModule/issues/250 |
| og:image:alt | I am using the .NET Core Redirection Module to forward some external traffic to an internal URL. The logs on the IIS reverse proxy site appear fine. info: Microsoft.AspNetCore.Hosting.Internal.WebH... |
| og:image:width | 1200 |
| og:image:height | 600 |
| og:site_name | GitHub |
| og:type | object |
| og:author:username | danielcrenna |
| hostname | github.com |
| expected-hostname | github.com |
| None | 52c76df668885aaff23b50bdca1fa1ea44ac9c1553e888ebc70ff1e4daa4625b |
| turbo-cache-control | no-preview |
| go-import | github.com/aspnet/AspNetCoreModule git https://github.com/aspnet/AspNetCoreModule.git |
| octolytics-dimension-user_id | 6476660 |
| octolytics-dimension-user_login | aspnet |
| octolytics-dimension-repository_id | 64516011 |
| octolytics-dimension-repository_nwo | aspnet/AspNetCoreModule |
| octolytics-dimension-repository_public | true |
| octolytics-dimension-repository_is_fork | false |
| octolytics-dimension-repository_network_root_id | 64516011 |
| octolytics-dimension-repository_network_root_nwo | aspnet/AspNetCoreModule |
| turbo-body-classes | logged-out env-production page-responsive |
| disable-turbo | false |
| browser-stats-url | https://api.github.com/_private/browser/stats |
| browser-errors-url | https://api.github.com/_private/browser/errors |
| release | 309153364422b3c499922d1a2a6404910a58ed8e |
| ui-target | full |
| theme-color | #1e2327 |
| color-scheme | light dark |
Links:
Viewport: width=device-width