IIS reports error 404 "The request filtering module is configured to deny requests that contain double escape sequences."

Table of Contents

Cause of error

Double escape sequences refer to situations where certain characters are escaped multiple times when escaping a string. In URL encoding, special characters are usually escaped to ensure that they can be correctly passed and parsed by the server. For example, a space is escaped as "%20", and the plus sign (+) is usually not escaped because it represents a space in a URL. However, if the server mistakenly escapes a character that has already been escaped again, a double escape sequence will be generated.
The server reported that the request filtering module was configured to reject requests that contained double escape sequences, which could mean that the server believed that the plus sign in the URL had been escaped twice, i.e., the plus sign was escaped as %2B and then escaped again as %252B, which is considered incorrect. The server may reject such a request because it could cause parsing errors or security issues.

The key to solving this problem is to ensure that the server interprets special characters in the URL correctly and avoid unnecessary escaping.

Revise applicationHost.config File configuration, please back up the file before modifying it just in case.

You can %SystemDrive%\Windows\System32\inetsrv\config Find the corresponding site configuration file in the folder, usually \applicationHost.config, and then open it with a text editor such as Notepad.

Search in configuration files <requestFiltering> In IIS 7, by default, the URLScan module may block URL requests that contain a plus sign.

exist <requestFiltering> section, you can add a <allowDoubleEscaping> element, set its value to true, to allow plus signs in URLs. Example:

<security> <requestFiltering allowDoubleEscaping="true"></requestFiltering> </security>