4

I am attempting to post to a page served by IIS6 and I am adding the following header:

Transfer-Encoding: chunked

When I do this, I get a 404 error: The system cannot find the file specified.. If I make the same request to the page without this header, it definitely exists.

Here are the headers - the only difference between the two requests is the chunking...

POST http://hostname/appname/index.html HTTP/1.1
Host: hostname
Connection: keep-alive
Transfer-Encoding: chunked
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.64 Safari/537.31
Content-Type: application/x-www-form-urlencoded
Referer: http://referrer/

And the body:

4
xxxx
0

The IIS metabase has AspEnableChunkedEncoding set to true at the W3SVC level and it is not overridden at the site level.

Why do I get a 404 error?

Update: I notice on the response for the unsuccessful request that the:

x-powered-by: asp.net

...header is absent. I don't know if that helps - it is there if I don't set the header in the request.

Fenton
  • 241,084
  • 71
  • 387
  • 401
  • You are posting to an html page. What are you trying to achieve? – IdoFlatow Sep 20 '13 at 22:11
  • .html extension is mapped to the aspnet isapi dll - so it is actually an aspx page. Sorry I didn't make that clear. – Fenton Sep 21 '13 at 11:34
  • 1
    Is URLScan installed? It could be blocking the header? – James L Sep 23 '13 at 15:33
  • Checking this now... the FAQ explains that it issues 404 responses for rule failures: `UrlScan v3.1 failures result in 404 errors and not 500 errors. Searching for 404 errors in your W3SVC log will include failures due to UrlScan blocking.` – Fenton Sep 30 '13 at 08:59

1 Answers1

1

Is URLScan installed? It could be blocking the header

James L
  • 16,456
  • 10
  • 53
  • 70
  • 1
    Yes - it was configured with `[DenyHeaders]\r\ntransfer-encoding:`. Here's 100 points for your trouble! – Fenton Sep 30 '13 at 13:01