Question

I have a web application that I’ve inherited that has double encoded URLS. If it where possible I’d simply fix the instances where the URLs are being double encoded, but this is not possible. I am able to process the URLs if I use:

<requestFiltering allowDoubleEscaping="True" />

Is it possible to apply this to only a single page?

Answer 1

Yes, it should be possible, you can add that in a <location path=’file’> tag inside the web.config of your application.

Example:

<location path="CustomHttpHandler">
  <system.webServer>
    <security>
      <requestFiltering allowDoubleEscaping="true" />
    </security>
  </system.webServer>
</location>

Or if you want to use the UI (IIS Manager), you can drill-down in the Tree all the way to the folder where the file is contained, then click the “Content View” and right-click the file and choose “Switch to Features View” at that point you will see the file in the Tree. Now you can set any IIS setting and it will only apply to that File, so go to the Request Filtering icon and set the value.