I'm struggling with a legacy app that uses special characters like %26 in the URL. The characters don't affect the app but can't be changed, so I'm trying to get IIS to deal with them.

I've tried to ignore them using multiple methods, but nothing seems to work.

So now I installed the IIS rewrite module and added a rewrite rule to web.config to replace the characters %26 with _, for example:

        <rule name="ampersand" patternSyntax="Wildcard" stopProcessing="true">
            <match url="*%26*" />
            <action type="Redirect" url="{R:1}_{R:2}" />

The problem is that IIS responds with "Bad Request" before the rewrite rule ever gets called. So my question is this: how can I change the order of precedence so that the mod rewrite filter will be called before IIS puts the ban hammer down on that URL?

1 Answer 1


try changing the rule to:

<match url="(.*)%26(.*)" />

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.