We have a Windows 2008 R2 server running IIS 7.5.

Applications running inside are occasionally making GET requests to themselves with a rather long parameter list (up to 3000 chars) and this, when rdp:ed to the server itself and triggered in a browser, Firefox yields the IIS blue error screen :

HTTP Error 404.15 - "The request filtering module is configured to deny a request where the query string is too long. Verify the configuration/system.webServer/security/requestFiltering/requestLimits@maxQueryString setting in the applicationhost.config or web.config file"

I tried:

  1. IIS manager
  2. default web site
  3. Request Filtering
  4. Url
  5. Edit feature settings
  6. Max query string: from 2048 to something higher.

As a result, firefox shows

"Server error in "/" Application in red and "The length of the query string for this request exceeds the configured maxQueryStringLength value."

sys32/inetsrv/config/applicationHost.config is edited with:

    <requestLimits maxQueryString="4096" />
    </requestFiltering>

I also tried to manually edit web.config like that:

    <security>
    <requestFiltering>
    <requestLimits maxQueryString="3000" maxUrl="1000" />
    </requestFiltering>
    </security>

Result: Same as in 1, which is not the blue IIS error screen.

Both changes: Same is in 1 and 2.

My questions are:

  1. As soon as I change the URL length or querystring params in the IIS manager or in web.config manually the error screen on the webserver turns from blue to the red-white-yellow Server Error in "/" Application, is this expected?

  2. How can I make the IIS accept longer than 2048 bytes (the default) query strings in GET requests, if at all possible?

I understand that browsers have their own restrictions but only IE should have the ~2000 chars limit (it truncates the rest from the address field). This seems to be an issue with the IIS server.

up vote 0 down vote accepted

Did you also configure it in the httpRuntime of your web.config file?

https://docs.microsoft.com/en-us/previous-versions/dotnet/netframework-4.0/e1f13641(v=vs.100)

<configuration> <system.web> <httpRuntime maxQueryStringLength="4000" /> </system.web> </configuration>

  • When I try to add a <system.web> like that, before or after <system.webserver> and directly under <configuration>, I get – David I Aug 16 at 13:25
  • Sorry for multiple comments, enter posts, can only edit for five mins, got ya.. anyway, only system.web and httpRuntime maxQueryStringLength gives the blue screen with 404.15, same as no system.web, telling me to change MaxQueryString. If I have the system.web with httpRunTime as well as <security> <requestFiltering> <requestLimits maxQueryString="3000" maxUrl="1000" /> under system.webserver I get <ows:Exception exceptionCode="NoApplicableCode"><ows:ExceptionText>java.lang.ClassCastException: [Ljava.lang.String; cannot be cast to java.lang.String – David I Aug 16 at 13:39
  • Right, first, thank you! Second, this is what I did: near the top under system.webserver I added the security - requestfiltering bit with MaxQueryString. Near the end of web.config I added the system.web and the httpruntime maxquerystringlength and now it accepts longer parameter lists : ) – David I Aug 17 at 8:09

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.