Question

Had a question from a client which stumped me.

They are using IIS 6.0 and for some reason, instead of making a normal request for a page on their server which I’ll call http://www.domain.com/Default.aspx someone typed http://www.domain.com/Default.aspx/randomstuff

It seems that IIS’s response was to serve Default.aspx as normal, but, as far as the browser is concerned, the path is http://www.domain.com/Default.aspx/ rather than http://www.domain.com/ and thus all relative paths to CSS, images, etc. fail

I looked at the traffic in Fiddler, and it seems that all of those image etc. requests, such as http://www.domain.com/Default.aspx/images/image.gif are ALSO returning the contents of Default.aspx, needless to say, not a valid image!

I don’t believe they are doing anything special with URL rewriting, but just to be sure, I tried an experiment on a freshly created ASP.NET web application and the results were the same.

So what is causing IIS to pass a URL like /Default.aspx/randomstuff to the ASP.NET pipeline as a request for Default.aspx? And can it be stopped, and made to just throw a 404 as you’d expect?

Answer 1

This is called the PathInfo component.

You can stop like this:

if (!String.IsNullOrEmpty(Request.PathInfo)) throw new HttpException(404);