HTTP Error 404.15 -Not Found

Question

The request filtering module is configured to deny a request where the query string is too long.

I am having above error, and I have been trying almost everything but no luck

My Project is MVC4 on Visual Studio 2013

things I have made sure are correct and tried.

There is no [Authorize] Attr on my classes with [AllowAnonymous] Attr.
I have added maxQueryStringLength="32768" maxUrlLength="65536" to in my config file
I have added -->
I have [AllowAnonymous] attr on my log on Actions in my controller.
I have no problem when I run the application in debug mode or without debug mode on Visual Studio.
here is my rout config routes.MapRoute( name: "Default", url: "{controller}/{action}/{id}", defaults: new { controller = "Home", action = "Index", id = UrlParameter.Optional } );
this is the error I am getting on the web server

score 9 · Answer 1 · answered Jan 03 '20 at 10:28

Insert/Update web.config file as like sample below

<configuration>
   <system.webServer>
       <security>
          <requestFiltering>
             <requestLimits maxQueryString="3000" maxUrl="1000" />
          </requestFiltering>
       </security>
   </system.webServer>
   <system.web>
       <httpRuntime maxQueryStringLength="32768" maxUrlLength="65536"/>
   </system.web>
</configuration>

score 5 · Answer 2 · edited May 23 '17 at 12:09

5

As the error message tells you

The request filtering module is configured to deny a request where the query string is too long.

At the screenshot you can clearly see that the returnUrl Parameter is huge.

So there are to solutions

Clear your returnUrl Parameter in your Controller Method [HttpPost] Login();
Add the following to your web.config :

web.config

<system.webServer>
  <security>
    <requestFiltering>
      <requestLimits maxQueryString="*"/> <!-- Replace * with any number, which is required -->
    </requestFiltering>
  </security>
</system.webServer>

In your case go definitively with Solution 1. It's simply a bug in your Code and easily fixed without touching the IIS or other config files.

See this post for more information about Request Query String Limit.

edited May 23 '17 at 12:09

Community

1
1

answered Feb 21 '17 at 14:54

Smartis has left SO again

5,025
4
31
45

Thank you for your reply. I have added the to Web.config but I am getting another error The length of the query string for this request exceeds the configured maxQueryStringLength value. – Frank Feb 21 '17 at 15:06
@Frank Why? Fixing the Code in your Controller, would be much simpler – Smartis has left SO again Feb 21 '17 at 15:08
How would you fix this on the controller ? thank you @Smartis – Frank Feb 22 '17 at 14:53
1

@Frank In your Controller must be a Method like this `[HttpPost] Login();` which should return a `Action` with the parameter `returnUrl`. Instead of adding every time something to this parameter, clear the value. This should only store the last `returnUrl` value and shouldn't blow up your requested URL. – Smartis has left SO again Mar 06 '17 at 09:02
I was able to fix this thank you for all of your help. – Frank Mar 30 '17 at 16:49

score 3 · Answer 3 · answered Mar 12 '21 at 14:11

just modify the web.config add

<configuration>
<system.webServer>
<security>
<requestFiltering>
<requestLimits maxQueryString="30000" maxUrl="10000" />  
</requestFiltering>
</security>
</system.webServer>
</configuration>

also add under <system.web>

<httpRuntime maxQueryStringLength="32768" maxUrlLength="65536"/>

score 1 · Answer 4 · answered May 02 '22 at 19:32

1

if you have already scaffolding the identity login , just add [AllowAnonymous] in the page (behind code) login, like this :

[AllowAnonymous]
public class LoginModel : PageModel { ....... }

answered May 02 '22 at 19:32

MOHAMED EL JIHAOUI

71
1
2

score 0 · Answer 5 · answered Dec 10 '18 at 13:07

0

I had the same problem, I replaced GET method with POST and it worked.

answered Dec 10 '18 at 13:07

Mehdi Souregi

3,153
5
36
53

Of course it did. POST has much more space that GET – Minasie Shibeshi Jun 14 '20 at 11:13

score 0 · Answer 6 · answered Apr 07 '22 at 20:58

Put [AllowAnonymous] in the Login Page(for Razor Project like mine) or the View's Controller(for MVC - I imagine).

Perhaps you scaffolded the Login Page, thereby making it subject - as soon as you hit Login button - to your fallback policy* in your Program.cs (now in .NET 6.0, Startup.cs for earlier .NET). Your fallback policy forbids any Page(view) without a policy, and since you have no policy in the login page, as soon as you hit the login it calls that view, and you get the error. I'm not sure that I understand why it isn't a nice error. Perhaps because it tries a hundred times to put that URL in and therefore it implies that in the 25252525225252522 etc and so forth message.

Luckily I was helped pinpointing the error because my app worked fine logging in and out without the fallback policy, but it was exactly that fallback policy that caused error.

By fallback policy, I refer to:

builder.Services.AddAuthorization(options => { options.FallbackPolicy = new AuthorizationPolicyBuilder() .RequireAuthenticatedUser() .Build(); });

HTTP Error 404.15 -Not Found

6 Answers6

Linked