IIS6 POST request failing with 500 error

[Ed Dearlove]

**Also posted in inetserver.iis newsgroup as I am unsure of where the
problem lies**

Hi,

I have a strange problem, or I may just be stupid, but wondering if anyone
can help with this one:


We receive a large number of very simple POST requests to our vb.net web
apps from our suppliers (all using php or jsp - if that has any relevance).
Historically our ,net apps have been hosted (still are!) on win2k boxes with
IIS5 with no problem, GET and POST requests work fine, from their apps,
IE5/6 ... all fine!

Now here is where the problem starts, recently put two new servers (2003 std
with IIS6) in our colo, installed the same apps, and they appear to work
fine (make GET requests from IE6 - fine) however our clients get a 500 error
when posting and when simulating a session through telnet the server
responds with 500.

All i can see in the logs is the request coming in as a POST with 500 as the
error code.

Any help much appreciated (if you need more info please let me know)

Many thanks in advance

 

[Rutger]

**Also posted in inetserver.iis newsgroup as I am unsure of where the
problem lies**

Hi,

I have a strange problem, or I may just be stupid, but wondering if anyone
can help with this one:


We receive a large number of very simple POST requests to our vb.net web
apps from our suppliers (all using php or jsp - if that has any relevance).
Historically our ,net apps have been hosted (still are!) on win2k boxes with
IIS5 with no problem, GET and POST requests work fine, from their apps,
IE5/6 ... all fine!

Now here is where the problem starts, recently put two new servers (2003 std
with IIS6) in our colo, installed the same apps, and they appear to work
fine (make GET requests from IE6 - fine) however our clients get a 500 error
when posting and when simulating a session through telnet the server
responds with 500.

All i can see in the logs is the request coming in as a POST with 500 as the
error code.

Any help much appreciated (if you need more info please let me know)

Many thanks in advance

In IE6, turn 'Show friendly error pages' on and off and find out if it
makes any difference. Don't know exactly what the case is but that's
what I've found ou once.

//Rutger

 

[Ed Dearlove]

Hi,

thanks for your thoughts, unfortunatly each time i connect to the page from
IE (Show friendly error pages on or off) it displays perfectaly. The only
way I can replicate the problem locally is to set up a manual telnet session
to the server

Ed

 

[Joerg Jooss]

Hi,

thanks for your thoughts, unfortunatly each time i connect to the
page from IE (Show friendly error pages on or off) it displays
perfectaly. The only way I can replicate the problem locally is to
set up a manual telnet session to the server

What request do you eumlate via telnet to reproduce the error?

Cheers,

 

[Ed Dearlove]

Hi Joerg,

the sample app I am using is a test one, so it can accept any parameters
and just logs the details of the request into a text file.

I am not too sure what you mean by 'What request do you eumlate via telnet
to reproduce the error?' but I will give you a full list of what I do when i
telnet it!

telnet xxx.xxx.xxx.xxx 80
POST /appname/page.aspx HTTP/1.0

Host: xxx.xxx.xxx.xxx
Content-type: application/x-www-form-urlencoded
Content-length: 9

test=true

If there is any other way of testing please let me know - also is there a
telnet app that you can see the local echo?

Thanks in advance

 

[Joerg Jooss]

Hi Joerg,

the sample app I am using is a test one, so it can accept any
parameters and just logs the details of the request into a text file.
Good,


I am not too sure what you mean by 'What request do you eumlate via
telnet to reproduce the error?' but I will give you a full list of
what I do when i telnet it!

Yeah, that's I meant. You're pretending to be a web client by typing in HTTP
requests via telnet

telnet xxx.xxx.xxx.xxx 80
POST /appname/page.aspx HTTP/1.0

Wait. There must be no empty line here, othwerwise your headers become the
message body.

Host: xxx.xxx.xxx.xxx
Content-type: application/x-www-form-urlencoded
Content-length: 9

test=true

You could perform another quick test here. Since you already pass a Host
header, you can safely change the protocol version to HTTP 1.1.

If there is any other way of testing please let me know - also is
there a telnet app that you can see the local echo?

You could create a test web form or build a test windows app. As far as the
local echo goes, I'd thought that any old telnet client can do that?

Cheers,

 

[Ed Dearlove]

Hi again!

firstly thanks for all your help, with that change to the telnet session you
mentioned it works perfectly with both HTTP1.0 and 1.1.....so i am totally
confused!!

 

[Joerg Jooss]

Hi again!

firstly thanks for all your help, with that change to the telnet
session you mentioned it works perfectly with both HTTP1.0 and
1.1.....so i am totally confused!!

Where do these POST requests from your third parties actually fail? Are they
rejected by IIS 6 right away, or do they cause an exception within the
ASP.NET pipeline?

Cheers,

 

[Ed Dearlove]

Rejected before ASP gets hold of them (I think - although I am still
checking) I have a whole load of debug code running in the .net and nothing
seems to get there

 

[Patrice]

I woudl start by trapping errors (using either customErrors tags or
Application_OnError). You can then mail this error so that you are aware of
waht's happening in your app without having to reproduce the problem...

Patrice

--

Hi again!

firstly thanks for all your help, with that change to the telnet session you
mentioned it works perfectly with both HTTP1.0 and 1.1.....so i am totally
confused!!

 

[Ed Dearlove]

Thanks Patrice,

I have been trying to get this to work, but the requests do not seem to be
geting as far as .net??!!

I woudl start by trapping errors (using either customErrors tags or
Application_OnError). You can then mail this error so that you are aware of
waht's happening in your app without having to reproduce the problem...

Patrice

--

 

[Ed Dearlove]

OK, finally problem has been solved, the solution is .net based, the problem
is the tightend security in IIS6 (as far as i can tell & I am no expert!!)

Here goes (in my laymans terms!)

It turns out that the data in the POST body being sent across by our
suppliers contains non-encoded XML tags, IIS6 sees these as potentially
harmful scripts and returns 500 internal server error. (IIS5 does not!)

the workaround...disable request validation on the page in question by
adding [ValidateRequest="false"] (without []) to the end of your <% Page
Language=.... .... ... ValidateRequest="false" %>

Anyhow thanks everyone for your help in solving this issue that has been
bugging me on and off for 6 months!!!!, it has all helped.