12

The reason I'm asking is because IIS protects certain ASP.NET folders, like Bin, App_Data, App_Code, etc. Even if the URL does not map to an actual file system folder IIS rejects a URL with a path segment equal to one of the mentioned names.

This means I cannot have a route like this:

{controller}/{action}/{id}

... where id can be any string e.g.

Catalog/Product/Bin

So, instead of disabling this security measure I'm willing to change the route, using a suffix before the id, like these:

{controller}/{action}_{id} // e.g. Catalog/Product_Bin
{controller}/{action}/_{id} // e.g. Catalog/Product/_Bin

But these routes won't work if the id contains the new delimeter, _ in this case, e.g.

// These URL won't work (I get 404 response)
Catalog/Product_Bin_
Catalog/Product/_Bin_
Catalog/Product/__Bin

Why? I don't know, looks like a bug to me. How can I make these routes work, where id can be any string?

Max Toro
  • 28,282
  • 11
  • 76
  • 114
  • Is this something you could accomplish with [UrlRewrite](http://www.iis.net/download/URLRewrite)? – Roman Apr 15 '11 at 15:29
  • Interestingly enough, Catalog/Product/_bin_ worked for me, but Catalog/Product/__Bin did not work. I'm checking with the developer to find out why that's the case. I would think that should work too. – Haacked Sep 19 '11 at 05:33
  • Is it possible that it occurs as well when doing something like **/0{id}** I have this issue right now and it seems to be 404 with SOME id's , but not for others... – Michiel Cornille Mar 05 '12 at 18:54
  • it works with 0_{id} but not (in all cases) with /0{id} -_- – Michiel Cornille Mar 05 '12 at 18:59

3 Answers3

7

Ok, I have a definitive answer. Yes, this is a bug. However, at this point I regret to say we have no plans to fix it for a couple of reasons:

  • It's a breaking change and could be a very hard to notice one at that.
  • There's an easy workaround.

What you can do is change the URL to not have the underscore: 

{controller}/{action}/_{id}

Then add a route constraint that requires that the ID parameter starts with an underscore character.

Then within your action method you trim off the underscore prefix from the id parameter. You could even write an action filter to do this for you if you liked. Sorry for the inconvenience.

Haacked
  • 58,045
  • 14
  • 90
  • 114
  • I just ran into this bug as well, it seems. The route would not match only when the *first* character of my id was the same as the literal prefix. http://stackoverflow.com/questions/8711829/why-wont-this-route-match – quentin-starin Jan 07 '12 at 19:49
0

You can use characters that are not allowed for a directory or file name like: *,?,:,",<,>,|.

lebrot
  • 21
  • 2
0

With ASP.NET MVC if you look at the source they have a hard-coded value for the path separator (/) and to my knowledge cannot be changed.

Chad Moran
  • 12,834
  • 2
  • 50
  • 72