URL SCAN blocks the Post Request

News Knowledge Base
1

Unable to Update runtime in machine template.

Validation Steps:

  1. Validate the IIS Logs
  2. Find the OData/machine endpoint in IIS request
  3. Find URL scan (Is blocking the request with 500 error code)

A new feature added for UrlScan Version 3.1 is the ability to create a rule list that lets to specify rules to disallow requests based on patterns matched against certain portions of an HTTP request.

Perform below steps:

  1. On the Taskbar, click Server Manager
  2. On the Server Roles page, expand Web Server (IIS), expand Web Server, expand Application Development, and then select ISAPI Filters
  3. Delete the URL SCAN rule.


To remove the URL filter:

  1. Open Internet Information Services (IIS) Manager
  2. Click the server node in the Connections pane. In the server Home page that appears, open ISAPI
  3. Select the URLscan extension
  4. In the Actions pane, click Remove
  5. Click OK.

The element can contain one or more elements, each of which defines an ISAPI filter enabled for the server or Web site.

Root Cause: Administrators may configure UrlScan to reject HTTP requests based on the following criteria,

  • The HTTP request method or verb
  • The file name extension of the requested resource
  • Suspicious URL encoding
  • Presence of non-ASCII characters in the URL
  • Presence of specified character sequences in the URL
  • Presence of specified headers in the request.