Fix max URL and query string length with web.config and IIS
I had a problem the other day that I believe qualifies as a blog post. An elmah.io user reported that refreshing the organization overview would generate a 404. After debugging the problem, I found out that the URL generated by that page can be too long. This post is an explanation of the error and how to fix it.
When looking at the error generated on localhost, I saw the following:
And in text:
HTTP Error 404.15 - Not Found
The request filtering module is configured to deny a request where the query string is too long
When looking at the Requested URL field at the bottom of the screenshot, it is clear that the URL is long. IIS enforces some limitations in the number of characters accepted as part of the query string. As suggested by the error message, this can be fixed by modifying the
maxQueryString settings in the
web.config file. Let's quickly recap the structure of an URL:
The error above is on the query string part, but there are other limitations as well. For the Path part, IIS also limits the number of allowed characters. This setting is named
maxUrl, which doesn't make a lot of sense (IMO) when looking at the breakdown above. Both
maxUrl have default values, as shown below:
The default values are quite decent and cover most scenarios. To support a very long query string (or path) as illustrated by this error, there's an easy fix.
As you probably already guessed, the fix is to change the
maxQueryString setting (or
maxUrl if the problem is in the path). To do so, modify the
security element in the
<configuration> ... <system.webServer> ... <security> <requestFiltering> <requestLimits maxQueryString="8192" /> </requestFiltering> </security> </system.webServer> </configuration>
In this example I have quadrupled the allowed number of characters in the query string.
For older websites, you need to change the setting as part of the
<configuration> ... <system.web> ... <httpRuntime ... maxQueryStringLength="8192" /> </system.web> </configuration>
Notice that when using the
httpRuntimeelement to configure max length, different default values exist. Most modern websites don't need to worry about this, though.
elmah.io: Error logging and Uptime Monitoring for your web apps