Limit URL Parameter Length in Web.Config

Question

Is it possible to add some kind of restriction to the web.config to limit URL parameter length? I want to prevent people at the earliest possible point from submitting too large URL parameters so the server doesn't get taxed more than necessary in the event that somebody tries to "attack" it with large invalid URL parameters.

Answer 1

See the following link:

http://learn.iis.net/page.aspx/143/use-request-filtering/

Here is an example of the IIS 7 config:

<configuration>
    <system.webServer>
        <security>
            <requestFiltering>
                <requestLimits
                    maxAllowedContentLength="30000000"
                    maxUrl="260"
                    maxQueryString="25"/>
            </requestFiltering>
        </security>
    </system.webServer>

Answer 2

http://www.iis.net/ConfigReference/system.webServer/security/requestFiltering/requestLimits

just set maxQueryString.

Answer 3

urlscan can probably help for iis6 scenerios