C# MVC: Trailing equal sign in URL doesn't hit route

Answer 1

EDIT: Original suggestion which apparently doesn't work

I'm sure the reason is that it thinks it's a query parameter called Key. Could you make it a parameter, with that part being the value, e.g.

www.example.com/Find?Route=Key=

I expect that would work (as the parser would be looking for an & to start the next parameter) but it's possible it'll confuse things still.

Suggestion which I believe will work

Alternatively, replace "=" in the base64 encoded value with something else on the way out, and re-replace it on the way back in, if you see what I mean. Basically use a different base64 decodabet.

Alternative suggestion which should work

Before adding base64 to the URL:

private static readonly char[] Base64Padding = new char[] { '=' };
...
base64 = base64.TrimEnd(Base64Padding);

Then before calling Convert.FromBase64String() (which is what I assume you're doing) on the inbound request:

// Round up to a multiple of 4 characters.
int paddedLength = (4 - (base64.Length % 4)) % 4; 
base64 = base64.PadRight(paddedLength, '=');

Answer 2

UrlEncode the encrypted (it is encrypted, right?) parameter.

If it is an encrypted string, beware that spaces and the + character will also get in your way.

---

Ok, so IIS 7 won't allow some special characters as part of your path. However, it would allow them if they were part of the querystring.

It is apparently, possible, to change this with a reg hack, but I wouldn't recommend that.

What I would suggest, then, is to use an alternate token, as suggested by Mr Skeet, or simply do not use it in your path, use it as querystring, where you CAN url encode it.

If it is an encrypted string, you haven't verified that it is or is not, you may in some cases get other 'illegal' characters. Querystring really would be the way to go.

---

Except your sample shows it as querystring... So what gives? Where did you find an IIS that won't allow standard uri encoding as part of the querystring??

---

Ok then. Thanks for the update.

RequestFiltering? I see. Still that mentions double-encoded values that it blocks. Someone created a URL Sequence to deny any request with the '%' characters? At that point you might want to not use the encrypted string at all, but generate a GUID or something else that is guaranteed to not contain special characters, yet is not trivial to guess.

Answer 3

IF you're passing data in the URL you should probably URL Encode it which would take care of the trailing =.

http://www.albionresearch.com/misc/urlencode.php