Re: Underscore and hyphen changed to ASCII code in URL?

From: Wade A. Hilmo [MS] (wadeh_at_microsoft.com)
Date: 12/07/04 

Date: Tue, 7 Dec 2004 08:00:10 -0800

Hi Daniel,

You are seeing this because http://website/abc-xyz results in a courtesy
redirect. When IIS builds the 302 response to do the redirection, it
encodes the URL to defeat cross site script injection vulnerabilities.

You can read the following thread for a discussion of this issue and some
more detail:

http://groups-beta.google.com/group/microsoft.public.inetserver.iis/browse_thread/thread/7bb278b98750b59e/0a9a1fe4b08362c3?q=hilmo+%22courtesy+redirect%22&_done=%2Fgroups%3Fq%3Dhilmo+%22courtesy+redirect%22%26hl%3Den%26btnG%3DGoogle+Search%26&_doneTitle=Back+to+Search&&d#0a9a1fe4b08362c3

Thank you,
-Wade A. Hilmo,
-Microsoft

"Daniel A" <DanielA@discussions.microsoft.com> wrote in message
news:494C4668-AA77-489D-BD73-8F2907FEE0E5@microsoft.com...
> Hi all,
>
> Why undercores and hyphens in directory names are changed to the ASCII
code
> by IIS in the URL response? But as long I have a "/" after the last
directory
> the URL is returned correctly. Exemple this http://website/abc-xyz is
> returned like this http://website/abc%2Dxyz. But it is returned unchanged
in
> those scenarios : http://website/abc-xyz/ or
http://website/abc-xyz/index.aspx
>
> Is anyone has an idea why,
>
> Thanks,
> --
> Daniel

Relevant Pages

  • Re: Post with redirect?
    ... How can I force a POST but actually redirect the user as well ... and it can't be done with PHP. ... return $response; ... its a credit card entry form on a completely separate server. ...
    (comp.lang.php)
  • Re: Newbie question about a web server
    ... When responding to the POST data received, it sends a 301 response, no ... I googled for 'http response code 301', and found that it is actually ... You are correct that it is a redirect response. ... especially as it comes up first in a google search. ...
    (comp.lang.python)
  • Re: Redirected request in HttpWebRequest does not maintain specified method!!
    ... XML-RPC client to expect to re-post the content after the redirect, ... redirected URL is just that--a response, ... An HTTP server response is just that: ... Otherwise, Steve, you need to extend the Blogger API to offer a GET ...
    (microsoft.public.dotnet.framework)
  • Re: Query: How do I design an ENTER page?
    ... >it to create a session variable reflecting their response. ... redirect them to the pages you ... Even if they bookmark it, ... it would need some form of protection ...
    (microsoft.public.frontpage.client)
  • Response.Redirect from SSL to non SSL with port drops port.
    ... When they post the data back, and the processing is done, it then tries to redirect them back to the non-SSL site. ... But the site is on a non-starndard port number. ... I place in the Response.Redirect() method the Fully qualified path to the URL and when ASP.NET makes the Response, the response drops the port number, therefore redirecting the user to a 404. ...
    (microsoft.public.dotnet.framework.aspnet)