1

Our error logger is picking up the following error periodically:

System.InvalidOperationException: Request format is unrecognized for URL unexpectedly ending in '/TheMethodName'

The reason this error is being thrown is because the request to the script service is using the GET method, and the default security settings only allow POST requests.

The strange part is that the only place in our code where we are calling this particular service method is through an $.ajax call, and it is specifically using type: 'POST'. There is no other place in the app where a GET request is made for this service.

The ui is making the POST call every 20 seconds to retrieve some data, and it does not seem that the GET's are interfering with that -- they are just extraneous. I've looked at the IIS logs, and I can see the proper POST requests, and then sometimes a GET request.

As an added wrinkle, it's not just this web service that is getting the extra GET calls -- we are logging these to several other service endpoints as well.

My guess is that the browser or a proxy server or something is making these calls on its own (like as part of prefetching or some sort of caching), but I have no evidence of that. In looking at the user agent for the bad requests, they are coming in from a variety of browsers.

Has anybody else seen this before, or have an idea of what might be causing it?

patmortech
  • 10,139
  • 5
  • 38
  • 50
  • 1
    Is your app exposed to the public on the internet already and this comes from scanning production event log ? – Ondrej Svejdar Sep 29 '14 at 14:26
  • I can see from the IIS logs that the bad requests are coming from the same IP address and user agent as the good requests surrounding it. So appears to be something that is happening from a valid user's browser or something related to him. If you can elaborate on what you mean by 'scanning production event log', I could check that aspect, too, just in case. – patmortech Sep 29 '14 at 18:22
  • I usually get those kind of requests from bots - even white hat bots are trying to send GET and HEAD requests "just in case" to any url they find in html markup (be it javascript, form tag with method=post, etc.). Black hat bots are worse, they try to imitate user agent string of popular browsers and ignore robots.txt. My point is if it does come from publicly exposed web site I wouldn't bother. – Ondrej Svejdar Sep 30 '14 at 08:05

0 Answers0