Question

Yesterday for about 2 minutes the error log for my site has this error message:

A potentially dangerous Request.Path value was detected from the client (?).

for 7 different errors relating to these two queries:

/flash/userImage.ashx?id=53210cd9-2e34-4b27-9315-28c3525cb15c&type=micrositePhoto&width=750
/flash/userImage.ashx?id=53210cd9-2e34-4b27-9315-28c3525cb15c

I am unable to produce this error by typing the URL into my website.

This is the stack trace:

at System.Web.HttpRequest.ValidateInputIfRequiredByConfig()
at System.Web.HttpApplication.ValidateRequestExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)

It seems to be something internal to asp.net/IIS.

What could have caused this error? Is it some hack attack? I don’t understand why it complained about the path then, when subsequent queries are fine. In my error log function, I am getting the pageURL like this:

pageURL = HttpContext.Current.Request.Url.ToString();

I log the following information about errors: the pageUrl, the error message, the stack trace, the error date, and the user logged in, if there is one. Is there something else I should log to help me debug this? I can’t think of anything.

Answer 1

A couple of things that might help:

1. Try checking the IIS server log files in addition to your own error log
2. Try using elmah for logging errors and exceptions (which can also be installed via NuGet), which logs all the request parameters and server variables for each exception.