118

The URL I'm trying to let work is one in the style of: http://somedomain.com/api/people/staff.33311 (just like sites as LAST.FM allow all sort of signs in their RESTFul & WebPage urls, for example "http://www.last.fm/artist/psy'aviah" is a valid url for LAST.FM).

What works are following scenarios: - http://somedomain.com/api/people/ - which returns all people - http://somedomain.com/api/people/staff33311 - would work as well, but it's not what I'm after I'd want the url to accept a "dot", like the example below - http://somedomain.com/api/people/staff.33311 - but this gives me a

HTTP Error 404.0 - Not Found
The resource you are looking for has been removed, had its name changed, or is temporarily unavailable.

I've set up following things:

  1. The controller "PeopleController"

    public IEnumerable<Person> GetAllPeople()
    {
        return _people;
    }
    
    public IHttpActionResult GetPerson(string id)
    {
        var person = _people.FirstOrDefault(p => p.Id.ToLower().Equals(id.ToLower()));
        if (person == null)
            return NotFound();
    
        return Ok(person);
    }    
    
  2. The WebApiConfig.cs

    public static void Register(HttpConfiguration config)
    {
        // Web API configuration and services
    
        // Web API routes
        config.MapHttpAttributeRoutes();
    
        config.Routes.MapHttpRoute(
            name: "DefaultApi",
            routeTemplate: "api/{controller}/{id}",
            defaults: new { id = RouteParameter.Optional }
        );
    }
    

I already tried following all the tips of this blogpost http://www.hanselman.com/blog/ExperimentsInWackinessAllowingPercentsAnglebracketsAndOtherNaughtyThingsInTheASPNETIISRequestURL.aspx but it still won't work.. I also think it's quite tedious and I wonder if there isn't another, better and more secure way.

We have our Id's internally like this, so we're going to have to find a solution to fit the dot in one way or another, preferably in the style of "." but I'm open to alternative suggestions for urls if need be...

2
  • 11
    Not an answer, but as to why your're getting a 404 for somedomain.com/api/people/staff.33311 - by default, IIS looks at this URL and sees the . as a file extension and invokes the static file handler, bypassing your MVC API. The answer you accepted (running all managed modules for all requests) works because you force every request to IIS to go through the ASP.NET pipeline (therefore, your controllers)
    – Henry C
    Jan 15, 2015 at 16:15
  • Closely related post here.
    – RBT
    Oct 19, 2017 at 2:19

9 Answers 9

149

Suffix the URL with a slash e.g. http://somedomain.com/api/people/staff.33311/ instead of http://somedomain.com/api/people/staff.33311.

10
  • 3
    @AgustinMeriles my answer could be considered more of a workaround than an actual answer, depends on your interpretation of the question. Oct 17, 2015 at 13:12
  • 5
    That does not work though when the dot is at the end of the URL section as in /people/member.
    – eYe
    Oct 23, 2015 at 13:18
  • 2
    No, what if I don't want a slash at the end?! It should not be required.
    – Josh M.
    Jan 6, 2016 at 18:15
  • 1
    @JoshM. This is a workaround, I didn't write ASP.NET. Also, the slash doesn't affect the request. It does, however, help make your intentions more clear as in google.com/my query goes here/ vs. google.com/subDomain my query goes here. Jan 6, 2016 at 18:34
  • 1
    @JoshM. - it's not ideal, yes. What i did was just add an 'endpoint' to the url, so instead of something like analytes/method/2008.(w)/ i have analytes/method/2008.(w)/detail. That way requests with a dot in them still work and i don't have that trailing slash hanging out like it doesn't belong. Hope that helps someone.
    – Jamie M
    Sep 18, 2017 at 19:45
116

Following setting in your web.config file should fix your issue:

<configuration>
    <system.webServer>
        <modules runAllManagedModulesForAllRequests="true" />
14
  • 4
    It did the trick. Though, are there any vulnerabilities by setting this option? Why isn't this the standard behaviour? Jan 9, 2014 at 6:59
  • 2
    Ok, for anyone's interest: I see my question above being answered here on the accepted answer at the time of writing (answer by Kapil Khandelwal): stackoverflow.com/questions/11048863/… Jan 9, 2014 at 7:03
  • 2
    Yes, it worked, bus others, I would like to know which particular module is required for this functionality to work?
    – Greg Z.
    Mar 17, 2014 at 20:36
  • 3
    When I tried this, it would only work if I put a '/' at the end of the path. Any suggestions why this is? On a side note, the answer below that specifically adds the 'UrlRoutingModule' instead of running all modules, also worked for me, although still with the issue that it requires a '/' at the end to work. Aug 5, 2014 at 23:43
  • 10
    stackoverflow.com/a/12151501/167018 is worth looking at if you are concerned (and rightfully so) about the performance impact of enabling runAllManagedModulesForAllRequests.
    – Henry C
    Jan 15, 2015 at 16:19
38

I've found that adding the following before the standard ExtensionlessUrlHandler solves the issue for me:

<add name="ExtensionlessUrlHandler-Integrated-4.0-ForApi"
     path="api/*"
     verb="*"
     type="System.Web.Handlers.TransferRequestHandler"
     preCondition="integratedMode,runtimeVersionv4.0" />

I don't think the name actually matters all that much except it probably helps if your IDE (Visual Studio in my case) is managing your site configuration.

H/T to https://stackoverflow.com/a/15802305/264628

4
  • 1
    I added it 'after' the standard line and it also worked fine. Feb 17, 2017 at 14:04
  • This should be the accepted answer. Does not require / at end of uri
    – daudihus
    Apr 3, 2017 at 1:16
  • 2
    Thanks for the BEFORE, because it wasn't working after!
    – Mese
    Feb 22, 2018 at 12:25
  • I believe the modules run in order of declaration, so always put more specific (or more important) ones before more generic ones.
    – BrianS
    Feb 26, 2018 at 4:52
25

I don't know what I am doing really, but after playing with the previous answer a bit I came up with another, perhaps more appropriate, solution:

<system.webServer>
<modules>
    <remove name="UrlRoutingModule-4.0" />
    <add name="UrlRoutingModule-4.0" type="System.Web.Routing.UrlRoutingModule" />
</modules>
</system.webServer>
4
  • Thanks, I also don't know what it is doing but it looks better than the other solution.
    – Thomas
    Jun 23, 2015 at 11:42
  • 1
    appears to move the url routing module (which is what's catching that the request includes an extension and then tries to handle it as a file) to the end of the list of modules, which is sufficient to put it after the module handling the api request. IMHO, this is the best workaround available from the ones I've seen on SO, at least ATTOW Oct 18, 2016 at 16:33
  • 2
    It isn't the relocation to the end of the list, it's the removal of the default precondition that this module only run for managed handlers. The default config uses this format: <add name="UrlRoutingModule-4.0" type="System.Web.Routing.UrlRoutingModule" preCondition="managedHandler" />
    – theta-fish
    Feb 22, 2017 at 17:00
  • Thanks - that would explain the behavior.
    – Greg Z.
    Feb 23, 2017 at 17:25
12

I found that I needed to do more than just set the runAllManagedModulesForAllRequests attribute to true. I also had to ensure that the extensionless URL handler was configured to look at all paths. In addition, there is one more bonus configuration setting you can add which will help in some cases. Here is my working Web.config:

<system.web>
    <httpRuntime relaxedUrlToFileSystemMapping="true" />
</system.web>
<system.webServer>
    <modules runAllManagedModulesForAllRequests="true" />
    <handlers>
        <remove name="WebDAV" />
        <remove name="OPTIONSVerbHandler" />
        <remove name="ExtensionlessUrlHandler-Integrated-4.0" />
        <add name="ExtensionlessUrlHandler-Integrated-4.0"  path="*" verb="GET,HEAD,POST,DEBUG,PUT,DELETE,PATCH,OPTIONS" type="System.Web.Handlers.TransferRequestHandler" preCondition="integratedMode,runtimeVersionv4.0" />
    </handlers>
</system.webServer>

Note, specifically, that the ExtensionlessUrlHandler-Integrated-4.0 has its path attribute set to * as opposed to *. (for instance).

5
  • 1
    I just got bit by the path="*.". Just curious, what is the reason people set that to path="*."?
    – JustinP8
    May 17, 2016 at 18:06
  • 1
    Actually, I changed it to path="*" and had a problem because we're hosting a documentation site side by side with our WebAPI and that site had problems with .jpg, .png, and other files with extensions.
    – JustinP8
    May 17, 2016 at 19:53
  • @JustinP8 Did you also set <modules runAllManagedModulesForAllRequests="true" /> ? That should make .NET handle those static files.
    – Josh M.
    May 17, 2016 at 21:25
  • 1
    Yes. I wound up doing that. I don't really like that though because now all the static files go through the .NET pipeline. Luckily, as this is a webAPI service, only the Swagger and Swashbuckle stuff for the API docs/helper site are affected.
    – JustinP8
    May 23, 2016 at 19:57
  • i found this broke all static file requests. error 500. I had runAllManaged... set to true.
    – Sam
    Nov 10, 2016 at 5:09
3

I'd use this in Web.config file:

<add name="ManagedSpecialNames" path="api/people/*" verb="GET" type="System.Web.Handlers.TransferRequestHandler" preCondition="integratedMode,runtimeVersionv4.0" />

before standard "ExtensionlessUrlHandler".

For instance in my case I put it here:

<handlers>
  <remove name="ExtensionlessUrlHandler-Integrated-4.0" />
  <remove name="OPTIONSVerbHandler" />
  <remove name="TRACEVerbHandler" />
  <add name="ManagedFiles" path="api/people/*" verb="GET" type="System.Web.Handlers.TransferRequestHandler" preCondition="integratedMode,runtimeVersionv4.0" />
  <add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="*" type="System.Web.Handlers.TransferRequestHandler" preCondition="integratedMode,runtimeVersionv4.0" />
</handlers>

So you force URLs of such pattern to be managed by you, instead of standard management as files in application directory tree.

2

I got stuck in this situation but appending / at the end of URL wasn't look clean for me.

so just add below in web.config handlers tag and you will be good to go.

<add name="Nancy" path="api" verb="*" type="Nancy.Hosting.Aspnet.NancyHttpRequestHandler" allowPathInfo="true" />
1
  • Can you explain what Nancy is and whether it is a library to be included in the project? Thanks!
    – bluish
    Nov 6, 2019 at 8:50
1

I found that both way works for me: either setting runAllManagedModulesForAllRequests to true or add ExtentionlessUrlHandler as following. Finally i choose to add extensionUrLHandler since runAllManagedModulesForAllRequests do have performance impact to the site.

<handlers>
  <remove name="ExtensionlessUrlHandler-Integrated-4.0" />
  <remove name="OPTIONSVerbHandler" />
  <remove name="TRACEVerbHandler" />
  <remove name="WebDAV" />
  <add name="ExtensionlessUrlHandler-Integrated-4.0" path="*" verb="*" 
       type="System.Web.Handlers.TransferRequestHandler" 
       preCondition="integratedMode,runtimeVersionv4.0" />
</handlers>
-1

I also faced this issue. I was under a circumstance where I was not supposed to play with IIS and website config related settings. So I had to make it working by making changes at the code level only.

The point is that the most common case where you would end up having dot character in the URL is when you get some input from the user and pass it as a query string or url fragment to pass some argument to the parameters in the action method of your controller.

public class GetuserdetailsbyuseridController : ApiController
{
     string getuserdetailsbyuserid(string userId)
     {
        //some code to get user details
     }
}

Have a look at below URL where user enters his user id to get his personal details:

http://mywebsite:8080/getuserdetailsbyuserid/foo.bar

Since you have to fetch some data from the server we use http GET verb. While using GET calls any input parameters can be passed only in the URL fragments.

So to solve my problem I changed the http verb of my action to POST. Http POST verb has the facility of passing any user or non-user input in body also. So I created a JSON data and passed it into the body of the http POST request:

{
  "userid" : "foo.bar"
}

Change your method definition as below:

public class GetuserdetailsbyuseridController : ApiController
{
     [Post]
     string getuserdetailsbyuserid([FromBody] string userId)
     {
        //some code to get user details
     }
}

Note: More on when to use GET verb and when to use POST verb here.

1
  • Not an appropriate solution if you're building a REST API. Jun 26, 2018 at 14:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.