"Forbidden (Invalid URL)"

It's not a matter of IIS5 being smart as much as it's just broken and
waiting to be taken advantage of

Using "../", aka"parent path traversal", is a known cannonicalization-based
security vulnerability. In fact, it is a part of the vulnerabilities that
CodeRed/Nimda tried to exploit.

The right thing is to fix your code such that it doesn't look like nor rely
on security vulnerabilities to function. This is an example where a
"feature" is both a security and compatibility issue, and we chose security
with no alternatives. Sorry to tell you, but your website was broken all
this time, so you should probably fix it.

--
//David
IIS
This posting is provided "AS IS" with no warranties, and confers no rights.
//
"EW" <anonymous.DeleteThis@discussions.microsoft.com> wrote in message
news:be9501c3ee19$cea0e5b0$a101280a@phx.gbl...
Hello,

I've been using IIS 5.0 for years, and based many of my
web implementations on using "http://servername/../" to
force the client back to the root of the web site. I
realize that ../ is not something a HTTP server is
technically supposed to process, but at least IIS5 was
smart enough to know that I intended it to serve the root
web site. IIS6 only returns "Forbidden (Invalid URL)."
Is there any way to make ../ work the way it used to?

It's more secure this way? Hah--at least my whole
intranet site used to work. It is not like "../" is a
seriously malformed directory.

Thanks.
 >> Stay informed about: "Forbidden (Invalid URL)"