Python. flask, wfastCGI, and IIS - Very short url length limit (or something)

Question

I'm using Python 3.10.4 and Flask on a Windows 2016 Server with IIS and wfastCGI.

I stripped down my Python script to bare minimum for testing:

from flask import Flask, request, abort, render_template
from functools import wraps

app = Flask(__name__, static_url_path='/dwapi')
app.config["APPLICATION_ROOT"] = "/dwapi"

@app.route("/dwapi")
def dwapi_index():
    return "Invalid URL Path"

@app.route("/dwapi/myroute/<startdate>/<propertyid>")
def get_data(startdate,propertyid):
    return "xxx"

if __name__ == "__main__":
    app.run()

When I use the URL:

http://myservdwiis/dwapi/myroute/2021-8-01/80712,80804

it works - the browser shows "xxx"

I then use this longer URL:

http://myservdwiis/dwapi/myroute/2021-8-01/80712,80804,53009,80602,80519,80517,80802,38025,80705,80514,80515,80516,80807,38026,80808,20001,38400,51022,51023,80522,38027,32010,80527,54130,54131,38456,38017,80520,80521,80528,80805,38018,80523,80524,08030,56120,56121,56122,56123,56124,98145,98142,98143,981

It returns:

Bad Request - Invalid URL
HTTP Error 400. The request URL is invalid

If I remove ONE character from the above URL, it works.

http://myservdwiis/dwapi/myroute/2021-8-01/80712,80804,53009,80602,80519,80517,80802,38025,80705,80514,80515,80516,80807,38026,80808,20001,38400,51022,51023,80522,38027,32010,80527,54130,54131,38456,38017,80520,80521,80528,80805,38018,80523,80524,08030,56120,56121,56122,56123,56124,98145,98142,98143,98

This returns "xxx" as it should.

It doesn't look like this should be too long. There are no limits set (that I can see) in IIS - it has the default 2048 limit. But the above is only 306 characters, counting the hostname and protocol.

What could be limiting this, or is it due to something else?

When I run this locally on my Windows 10 system, not through IIS or wfastCGI, it does not have this issue. .

score 0 · Answer 1 · answered Nov 21 '22 at 03:18

In addition to iis settings, you can also set registry keys to tell HTTP.sys to allow longer URLs. By default, HTTP.sys permits 255 segments at a maximum length of 260 characters each. That 260 character limit was the cause of this issue.

You can change that setting in the registry. once you reboot, the url will work.

Registry:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\HTTP\Parameters]
"UrlSegmentMaxLength"=dword:00000400

This will effectively set the segment length to 1024.

More information you can refer to this link: Response 400 (Bad Request) on Long Url.

Python. flask, wfastCGI, and IIS - Very short url length limit (or something)

1 Answers1