8

I have a large .NET 2 web application that has been updated to target the .NET 4.0 framework. Since the update, I am seeing the following error recurring regularly in my logs:

This is an invalid webresource request.

The resource requested is "~/WebResource.axd" As far as I can tell, the request looks fine in that there's a long querystring with keys (keys are d, t) and values for those keys.

Has the mechanism for generating requests to WebResource.axd changed between framework versions? Does anyone have any advice about how to go about debugging this issue?

Edit: I found a way to decrypt the web resource request querystring (code follows). The requested resource is pCSSFriendly|CSSFriendly.CSS.Menu.css which looks like an issue with addressing the CSSFriendly.MenuAdapter resource which is used by the application. That leading "p" looks like it could be the problem. 

private string DecryptWebResource(string urlEncodedData)
{
    byte[] encryptedData = HttpServerUtility.UrlTokenDecode(urlEncodedData);
    Type machineKeySection = typeof(MachineKeySection);
    Type[] paramTypes = new Type[] { typeof(bool), typeof(byte[]), typeof(byte[]), typeof(int), typeof(int) };
    System.Reflection.MethodInfo encryptOrDecryptData = machineKeySection.GetMethod("EncryptOrDecryptData", System.Reflection.BindingFlags.Static | System.Reflection.BindingFlags.NonPublic, null, paramTypes, null);

    try
    {
        byte[] decryptedData = (byte[])encryptOrDecryptData.Invoke(null, new object[] { false, encryptedData, null, 0, encryptedData.Length });
        string decrypted = Encoding.UTF8.GetString(decryptedData);
        return decrypted;
    }
    catch (System.Reflection.TargetInvocationException)
    {
    }

    return String.Empty;
}
kristian
  • 22,731
  • 8
  • 50
  • 78
  • do you see the user agent making the request in your logs? Is the user agent a bot rather than a regular browser. If it's a browser, is it always a specific browser? – Shiv Kumar Feb 14 '11 at 05:23
  • Any chance you can show use the actual request url (with any modifications required by you)? – Shiv Kumar Feb 14 '11 at 05:24
  • @Shiv - user agent is not a bot, no specific browser. actual requested url is: "/WebResource.axd?d=mMV7RYieQ41tpTxPsIlhBcWLOEc_3Zk34EIeVXcAdmd_v2A7LNXIx4APFE1uwxEunSxoFByBQlJC-llRVaRlyz7B-OlDyh0CM5hgc8nbEkFNjAFf0&t=634273401161119442" – kristian Feb 14 '11 at 21:21
  • 1
    I have the same problem here. New server, same code (copy/pasted entire site) works on a previous server. I did encounter this problem once, but I can't remember how I solved it. – thomasb Nov 10 '11 at 10:32
  • 1
    After reading this post : http://stackoverflow.com/questions/5676232/webresource-axd-problem-in-asp-net-2-0 I noticed that the server wasn't even in the correct month (it indicated june, while we are in november). I fixed it, and... it works ! Really weird. – thomasb Nov 10 '11 at 10:37
  • 2
    No, the leading "p" is not the problem: I tried to decode the d param of working WebResource requests, and the leading "p" is there too. – lencinhaus Feb 09 '12 at 19:59
  • Just to save others the trouble; To implement the code chunk, you will need to reference System.Web and System.Configuration, and add ... using System.Web; using System.Web.Configuration; – Steve Hibbert Nov 19 '15 at 15:46

1 Answers1

2

Has the mechanism for generating requests to WebResource.axd changed between framework versions?

Apparently applying security updates (and certainly changing framework major versions) can alter the client-server interaction involving WebResource.axd in such a way as to cause this error. We saw this error after applying patches and the cause seems to be client side caching http://forums.asp.net/t/1609380.aspx - the errors went away after 30 days or so.

Craig A
  • 1,368
  • 12
  • 11