20

I'm implementing a custom controller in ASP.NET MVC and really want to be able to use a colon in the urls, so that I can identify class/column names and their values, like so:

http://example.com/user:chaiguy

...but apparently ASP.NET or IIS doesn't allow colons in urls. I did some digging and apparently it's considered a security issue, but, I'm using MVC and am handling all url paths manually (just treating them as strings), and not relating them to the file system, so I'm pretty sure this doesn't apply.

I also heard some talk about implementing a custom Http handler or something.

Any thoughts or ideas would be much appreciated.

Er.... why? Seriously, why break standards? – Randolpho

...

I suggest, then, that you investigate building a web service. WCF is a nice technology for that, and it hosts well in IIS.

I happen to like urls, and WCF is way too complicated for my purposes. I want it to be url-compatible, like REST, but capable of more than just navigating hierarchies, or doing well laid-out things. The problem I have with /users/chaiguy is that it is interpreting hierarchy where there is none: in my system "user" is a class, it's not a folder. user:chaiguy means the instance of the user class with the value of "chaiguy", and that is a single entity, that has the potential of having child-entities. So for example:

/user:chaiguy/name

...I would like to display the name of that entity. If I did this with your method, it would look like this:

/users/chaiguy/name

The problem is how do you know what's the class and what's the value? It could be interpreted as

/users/chaiguy:name

in my system, and that doesn't make sense. See what I'm getting at? To give a slightly more complicated example, suppose we want to select a child of the user entity out of multiple instances. So a user might have several email addresses. To select one, we might use:

/user:chaiguy/email:me@here.com/

So it is in fact recursive. It's not a file path, it's more like an XPath (or maybe similar to jQuery based on what little I know of it yet). That is, it's more of a dynamically-evaluated query selection than a hardwired file path. It gets evaluated on the server.

Make no mistake, I'm not building a typical web site or even web service here.

dbc
  • 104,963
  • 20
  • 228
  • 340
devios1
  • 36,899
  • 45
  • 162
  • 260
  • What version of IIS? 6? – Sean Bright Mar 20 '09 at 18:47
  • To be honest I'm just running it in the ASP.NET development server at the moment, not 100% sure what my actual web host is running. – devios1 Mar 20 '09 at 18:52
  • Ah. Then the colon will be intercepted before it even hits an HttpHandler. So you might be S.O.L. – Sean Bright Mar 20 '09 at 18:56
  • Hmm, bummer. I guess I could do this with url parameters easily enough, e.g. ?user=chaiguy, but are parameters supported within path segments, like "/?user=chaiguy/address" ? – devios1 Mar 20 '09 at 19:01
  • If you use query parameters, you are losing one of the biggest benefits of ASP.NET MVC: RESTful URLs. – Randolpho Mar 20 '09 at 19:04
  • Also, I'm 95% certain you can't use a query parameter list within a particular path segment. – Randolpho Mar 20 '09 at 19:06
  • REST doesn't work with query parameters? I thought REST was just url-driven interaction. Why would query parameters not count? – devios1 Mar 20 '09 at 19:08
  • Yes I verified the path segment thing, it just treats everything following the ? as part of the query string, including any further slashes. – devios1 Mar 20 '09 at 19:09
  • how about an encoded colon? %25 or whatever a colon actually is. Or may I suggest user(name) or similar. – No Refunds No Returns Feb 13 '10 at 22:28
  • 3
    Having this same question, and I noticed, Wikipedia uses colons in the path segment: [2001: A Space Odyssey](http://en.wikipedia.org/wiki/2001:_A_Space_Odyssey_%28film%29). Aren't they, like, the #3 site on the internet? Also note that, in Firefox, if you copy the address, it encodes the parens but not the colon. However, if you call encodeURIComponent(':'), you get "%3A". That's my litmus test. Colon is off-limits (too bad, I have a use for this, too). – harpo May 14 '11 at 00:33
  • 5
    Indeed, wikipedia uses colons *all over the place*, even in very prominent places where there's no apparent benefit, such as their [contact us](http://en.wikipedia.org/wiki/Wikipedia:Contact_us) page. You gotta wonder, if it's so dangerous, how do they get away with it? Of course, I realize that wikipedia does not use .NET, but the question (for me, anyway) really revolves around whether colons are *legal* characters in URL's, regardless of platform. – harpo May 14 '11 at 01:02

8 Answers8

20

Change the requestPathInvalidCharacters attribute of httpRuntime in web.config:

<httpRuntime maxRequestLength="20480" requestValidationMode="2.0" requestPathInvalidCharacters="" maxQueryStringLength="20480" />

and ASP.NET should no longer block colons from your request path.

Jacob Krall
  • 28,341
  • 6
  • 66
  • 76
4

Answered similar question here: https://stackoverflow.com/a/12037000/134761

It seems that ASP.net does not allow colons before the '?' in an URL, even if it is encoded as %3A.

For example, these won't work:

http://foo.org/api/persons/foo:bar

http://foo.org/api/persons/foo%3abar

But this works:

http://foo.org/api/persons?id=foo%3abar

In all examples, we would expect ASP.NET MVC to pass "foo:bar" as an id argument, properly decoded. I just tested this with MVC4 and it seems to work. It is annoying that it doesn't accept the URL encoding before the question mark though, but I'm sure there is a good reason for it. Probably to keep everything before the question mark a valid URL and any arguments after the question mark.

Community
  • 1
  • 1
angularsen
  • 8,160
  • 1
  • 69
  • 83
  • 1
    Actually `http://foo.org/api/persons?id=foo:abar` will work fine as well - no need to escape the colon. – Evgeniy Berezovsky Oct 19 '12 at 02:30
  • As I said, this rule seems to apply only to the path, meaning everything on the left side of the question mark. Colon is allowed on the right side of the question mark. – angularsen Oct 19 '12 at 07:47
1

Try setting HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\HTTP\Parameters\AllowRestrictedChars. This is from http://support.microsoft.com/?id=820129. I don't know whether ASP.NET/MVC does some checking on their own but if it's only http.sys blocking you, this should fix it.

Sriram Krishnan
  • 296
  • 2
  • 11
  • Is the colon even valid in a URL at that point? If not, then just don't do this, as http.sys will not be the only piece of software that won't like it. – John Saunders Jul 07 '09 at 09:09
1

This web.config setting worked for me. It accepts colons (:) in the url.

<httpRuntime targetFramework="4.6.1" requestPathInvalidCharacters=""/>
Siegfried Niedinger
  • 41
  • 3
1

I suggest you rethink what you want to do. Use pathing to indicate context and hide your class and field names, mapping particular contexts within your URL paths to class names and fields. If you need to indicate a user, for example, build your URL layout like example.com/users/chaiguy rather than example.com/user:chaiguy.

Cœur
  • 37,241
  • 25
  • 195
  • 267
Randolpho
  • 55,384
  • 17
  • 145
  • 179
  • 4
    I realize that's an option and appreciate the suggestion, but I'm really keen on doing it this way. If I can't use a colon, I will likely end up using a different symbol, but a colon would be ideal. – devios1 Mar 20 '09 at 18:54
  • Because what I want to do is very different, and involves url-based interaction with a non-web system. – devios1 Mar 20 '09 at 19:10
  • I suggest, then, that you investigate building a web service. WCF is a nice technology for that, and it hosts well in IIS. – Randolpho Mar 20 '09 at 19:11
0

Actually there is WCF REST available, and you can easily get up and running within an hour by using the WCF Starter Kit available here. This takes the power of REST and merges it with the ease of WCF. Also with WCF you can also create your own transport layer if you need to that can intepret URL's in any way you wish. One interesting thing about the starter kit is that it allowed spaces in the Url, which actually caused some headaches for true REST fundi's.

I wasn't keen on looking at it due to WCF, but you really don't need to know that much. The solution creates everything you need, just add the code.

BinaryMisfit
  • 29,219
  • 2
  • 37
  • 44
-4

I would suggest using a period. REST, based on HTTP protocol, is an example of building a new use for HTTP that kept to standards and was highly successful. Perhaps you can do that.

AND a '.' is a standard 'class.method' or 'class.attribute' in many langauges.

Now ME, I wanted to use the colon in time URL parameters, and some places are doing it. I still have to see if I can get away with it.

PS, for me, I may use this: http://www.businesscasualblog.com/2009/07/how-to-share-a-link-to-a-specific-timecode-in-youtube-video.html

esentially '--h--m--s'

Dennis
  • 747
  • 7
  • 15
-10

Is a colon valid in a url? Short answer no.

Long answer, yes if it's in a url fragment.

Example: http://site/gwturl#user:45/comments (note the colon proceeds the hash tag)

Sources

  • this answer,
  • Is a colon safe for friendly-URL use?
  • along with a personal test of just adding : to a url in ASP.NET and getting the YSOD with A potentially dangerous Request.Path value was detected from the client (:)
Community
  • 1
  • 1
Chris Marisic
  • 32,487
  • 24
  • 164
  • 258
  • 2
    -1 A colon is valid in an URL. Check the [grammar of RFC 2396](http://tools.ietf.org/html/rfc2396#appendix-A), which is referred to by the [HTTP 1.1 spec](http://tools.ietf.org/html/rfc2616), or the [grammar of the newer RFC 3986](http://tools.ietf.org/html/rfc3986#appendix-A). You'll find that the colon is also valid in both path and query. – Evgeniy Berezovsky Oct 19 '12 at 01:29
  • @EugeneBeresovksy meh I support my answer, specifically for the last point. – Chris Marisic Mar 11 '14 at 18:08
  • Re: your last point. The OP was aware of that problem, which is why he asked. I linked to the relevant RFCs that show that colons are valid. In fact, it might be colons in fragments that can be a problem ([depending on the HTML version used](http://stackoverflow.com/a/2053441/709537)). That said, the various HTTP and HTML specs are conflicting at times, in general though, colons are valid. That asp.net does not like them and tries to provide some pseudo security (that can luckily be switched off using the `requestPathInvalidCharacters` flag) is a different matter. – Evgeniy Berezovsky Mar 13 '14 at 01:41