IIS error 404 "The request filtering module is configured to reject requests containing double escape sequences."

Table of Contents

Error reason

Double escape sequences refer to situations where certain characters are escaped multiple times during string encoding. In URL encoding, special characters are typically escaped to ensure they are correctly transmitted and parsed by the server. For example, a space is escaped as "%20", and the plus sign (+) is usually not escaped because it represents a space in a URL. However, a double escape sequence occurs if the server mistakenly escapes a character that has already been escaped.
The server reports that its request filtering module is configured to reject requests containing double-escaped sequences. This could mean the server considers a plus sign in the URL to have been escaped twice—that is, escaped as %2B and then as %252B—which is considered incorrect. The server may reject such requests because it could lead to parsing errors or security issues.

The key to solving this problem is to ensure that the server correctly interprets special characters in the URL and avoids unnecessary escaping.

Revise applicationHost.config File configuration: Please back up the file before making any changes, just in case.

You can do it by %SystemDrive%\Windows\System32\inetsrv\config Locate the corresponding site configuration file in the folder; it is usually named [filename]. \applicationHost.configThen open it using a text editor (such as Notepad).

Search in the configuration file <requestFiltering> Partially. In IIS 7, by default, the URLScan module may block URL requests containing a plus sign.

exist <requestFiltering> In this section, you can add a <allowDoubleEscaping> Element, set its value to trueThis allows plus signs in URLs. Example:

<security> <requestFiltering allowDoubleEscaping="true"></requestFiltering> </security>