HTTP Error 404.15 - Not Found ...because the query string is too long

Question

I've checked lots of posts about this error but not been able to fix the problem yet.

I have simple MVC5 website built in VS2013 running on Windows 8 pro. When the site was created the option for individual accounts was selected. I now need to enable windows authentication so that only AD account users can use the website and also authorisation so that I can limit access to certain views / controllers to particular AD groups.

Having selected the web project within VS I have updated the properties window (F4) so that Anonymous Authentication is set to disabled and Windows Authentication is set to Enabled.

The web.config for the project now contains the following sections:

<system.web>
    <authentication mode="Windows" />
    <compilation debug="true" targetFramework="4.5" />
    <httpRuntime targetFramework="4.5" />
    <authorization>
      <deny users="?" />
    </authorization>
  </system.web>
  <system.webServer>
    <modules>
      <remove name="FormsAuthenticationModule" />
    </modules>
  </system.webServer>

I access the site from IIS or F5 I get the error: HTTP Error 404.15 - Not Found The request filtering module is configured to deny a request where the query string is too long. I notice that something has looped to give a ReturnUrl which is a repeating long concatenation within the query string.

Within the IIS\Authentication section, I have set to disabled "Anonymous Authentication, ASP.Net Impersonisation, and Forms Authentication". Within the section IIS.Net Authorization Rules I have set to Deny "Anonymous Users" and Allow "All Users"

Where am I going wrong?

score 28 · Accepted Answer · answered Feb 12 '15 at 20:47

The only time I've personally run into this issue is when I accidentally added [Authorize] to a child action that was used in the layout. Adding [Authorize] to your sign in action would have the same effect or simply neglecting to add [AllowAnonymous] on your sign in action, when the controller it is in has [Authorize] on it. Long and short, this is being caused by something requiring authorization on the actual sign in page, which then causes you to be redirected to the sign in page, which needs authorization, causing you to be redirected to the sign in page, etc.

tl;dr

Make sure your sign in / login action does not have [Authorize].
Make sure your sign in / login action does have [AllowAnonymous].
Make sure no child actions used in your layout or sign in page have [Authorize] or have [AllowAnonymous] if they are in a controller decorated with [Authorize].

Thanks Chris, I had a startup.cs that was redirecting to account/login. The cause of the problem was I chose the wrong option for Authentication when I created the website - I'd chosen individual accounts rather than Windows Authentication. I found best way to solve was to create a new web application, choosing Windows Authentication then comparing the config of both. — Rob Bowman, Feb 16 '15 at 14:43

score 12 · Answer 2 · edited Oct 09 '17 at 05:08

12

I got this error when I enabled Windows authentication. I wanted to authorize the user based on Windows login and I do not want login page in my application.

I got the error fixed by adding the below in my Web config file.

Under the tag system.web, changed authentication mode="None" to authentication mode="Windows"
Under tag appSettings, added add key="owin:AutomaticAppStartup" value="false"

edited Oct 09 '17 at 05:08

Ajay2707

5,690
6
40
58

answered Apr 14 '16 at 06:30

Rakesh Karthik

121
1
3

1

I'd like to know why the appSettings key is required for this to work. I swear I had it working before without it, but I get the "query string is too long" error like the question asker if I don't use it. – Zack Aug 29 '16 at 15:38
4

I was in the same situation as yourself. Adding the `` under `` did the trick. Thanks! – Trevor Nestman Dec 30 '16 at 20:33

score 6 · Answer 3 · edited Jun 11 '19 at 19:43

You may have a function in startup that redirects you to a login page. You must disable it.

I created the project by default authentication method which creates an account controller and its dependencies. When I changed the authentication method to Windows, the mentioned error was raised.

What I did was comment out the ConfigureAuth(app) function in my Startup.cs file to resolve the issue.

score 1 · Answer 4 · answered Sep 22 '16 at 17:43

1

I had the same problem..

Check under Project Properties..

Anonymous Authentication=False
Windwos Authentication=True

answered Sep 22 '16 at 17:43

Diego

2,238
4
31
68

score 0 · Answer 5 · answered Jan 10 '20 at 14:11

We ran into a similar issue and our authorize filters were correctly implemented. I am leaving this here in case someone else runs into same problem with IIS 10.

After working with Microsoft support, we determined that the .Net Authorization Rule was not enabled on the server level.

HTTP Error 404.15 - Not Found ...because the query string is too long

5 Answers5

Linked