JPElectron wrote on Mon, 25 Feb 2008 22:33:27 -0800 (PST):
> Based on some DNS trickery I am able to resolve the domains of some
> sites (lets just say unwanted sites) to my own IIS server instead (this
> based on corporate policy)
> Here are the sample URLs, although I've changed the domain-names to
> protect the guilty...
Have you got URLScan installed and enabled? It has options for setting
allowable lengths on URLs. Also there are registry settings for HTTP.sys,
but I've checked my own server and they're not present by default:
The HTTP.SYS component used by IIS 6.0 allows size limits to be set on
various parts of the request. The values can be changed by modifying
AllowRestrictedChars, MaxFieldLength, UrlSegmentMaxLength, and
UrlSegmentMaxCount in the registry under the following registry keys:
•HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Services\HTTP\Parameters\AllowRestrictedChars
•HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Services\HTTP\Parameters\MaxFieldLength
•HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Services\HTTP\Parameters\UrlSegmentMaxLength
•HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Services\HTTP\Parameters\UrlSegmentMaxCount
(above from
http://www.microsoft.com/technet/security/tools/urlscan.mspx)
--
Dan
>> Stay informed about: URL too long results in Bad Request (Invalid URL)