0

This is a valid url

URL1:

http://www.itsmywebsite.com/showproduct.aspx?id=127
http://www.itsmywebsite.com/browseproduct.aspx?catid=35

but this is not

URL2:

http://www.itsmywebsite.com/showproduct.aspx?id=-1%27
http://www.itsmywebsite.com/browseproduct.aspx?catid=-1%27

How can I block URL2 and the ones containing a string of format "-1%27" and invalidate the request. It's an automated bot sending this request so basically I want to just block the request in probably Global.asax? Please advise.

2 Answers 2

1

Well, those are both perfectly valid URLs. Your "URL2" is simply percent-encoded. Since 0x27 is an ASCII apostrophe, your percent-encoded URL2s are exactly the same as

  • http://www.itsmywebsite.com/showproduct.aspx?id=-1'
  • http://www.itsmywebsite.com/browseproduct.aspx?catid=-1'

Perhaps your web page should be validating the data it receives on the query string and throwing an error.

1
  • Wow never thought of that. Experience matters! How do I then block any url that starts with -1. The problem with handling these url's is my HealthMonitoring kicks in and my aspnet_WebEvent_Events table is full of "An unhandled exception has occurred." errors because of these url's
    – CuriousDev
    Nov 28, 2013 at 0:32
0

Which version of iis are you using? If 7.0 or later use the URL rewrite module to reject invalid urls such as those ending in =-1

See an example blocking domains ( regex patterns ) here: http://www.hanselman.com/blog/BlockingImageHotlinkingLeechingAndEvilSploggersWithIISUrlRewrite.aspx

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.