Score:1

IIS accepting requests with zero-width characters

ao flag

We're running an API behind a pair of load-balanced IIS v10 servers that route the request to a pair of Tomcat servers (historical reasons for this architecture).

A couple of instances have come up when a request is coming through where the URI includes a zero-width control character. This value isn't coming through as encoded, and is appearing with this control character in this log files.

Our issue is IIS is allowing this request through but Tomcat is blocking it due to it not conforming to RFC7230 and RFC3986. That makes perfect sense, but it's weird that IIS is allowing a non-RFC compliant request through.

Is there a configuration option that will allow us to block non-RFC compliant requests at the IIS level, or is IIS just allowing certain things to occur, just because?

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.