I have a couple of ASP.NET MVC websites running on IIS 8 with UrlScan 3.1 enabled. I also have some logging enabled on these websites which catch unhandled exceptions and writes them to a log table in the database.
I am finding a lot of exceptions coming from these websites along the lines of:
System.Web.HttpException
The controller for path '/Rejected-By-UrlScan' was not found or does not implement IController.
By looking at my own logs I can see the request URL that generated this error looks something like the following (real domain replaced with sample):
/Rejected-By-UrlScan?~//https://mywebsite.com/login/login/?aspxerrorpath=/Rejected-By-UrlScan
Seeing as I can't tell what really triggered this request I then had a look in the log files that UrlScan generates; I can see lots of reasons why some URLs might be getting rejected, some examples are:
2014-02-11 02:42:29 119.147.146.189 4 GET //https://mywebsite.com/login/login Rejected extension+not+allowed file+extension .com -
2014-02-11 02:42:32 119.147.146.189 4 GET //https://mywebsite.com/login/login/?aspxerrorpath=/Rejected-By-UrlScan Rejected URL+contains+dot+in+path URL - -
2014-02-11 02:42:37 119.147.146.189 4 GET //https://mywebsite.com/scripts/jquery-1.9.1.min.js Rejected URL+contains+dot+in+path URL - -
2014-02-11 08:24:19 79.122.154.178 6 OPTIONS /Content/Styles/ Rejected verb+not+allowed HTTP+method - -
What I don't understand from these log files is that if the URLs are rejected why do my websites continue to function?
So I have two questions based on this:
- Should I be concerned about any of these rejected URLs? I'm aware that UrlScan can be configured to allow/deny certain things but I don't want to mess around too much with it if I can help it.
- If I should allow UrlScan to work as it is configured is there a way to stop the MVC websites from generating these routing errors? They are currently taking up a lot of my log table and I don't see them as being critical errors I should be worried about. For instance I'm aware you can ignore routes but I'm not sure of the syntax I would need.
