One of my clients just had their ISA 2000 Server upgraded to ISA 2004 and were having some weird problems and finally got to the bottom of it – HTTP Request Filtering.

Symptoms

1) There was one ASP.NET 1.1 app that was having problems with buttons on new records that did a server.transfer. But on pre-existing records, the server.transfer worked.

2) In one of the ASP classic apps, we saw a pattern (pointed out by a non-programmer who asked “what about that ampersand?”!) where hyperlink requests with multiple query parameters failed but single query parameters succeeded.

The Pattern

Thanks to the eagle eyes of that user, I went back and looked more carefully at the asp.net app. Though the server.transfer involved only one query parameter, it was the page it was coming from that was the issue since the url doesn’t change with a server.transfer. And indeed, the new records had multiple parameters but the pre-existing ones did not. (I wrote this app over 3 years ago, so I definitely wasn’t too fresh on it!)

The Solution

So we went back to the i.t. guy and asked him to check the HTTP Filtering in ISA for either URL length or the ampersand and wouldn’t you know it – the ampersand had come over from ISA 2000 (where it was ignored) and fallen into the list of forbidden URL characters!

Ha!!

  Sign up for my newsletter so you don't miss my conference & Pluralsight course announcements!