URLEncoded route parameters are not respected

[BarryBotha]

%2F interpreted as / when routing

As an example, the URL:

/sportbet/BACK/8%2F10/Y

gets interpreted as:

/sportbet/BACK/8/10/Y

resulting in

Cannot GET /sportbet/BACK/8/10/Y

because of the extra / being interpreted when routing.

I am not sure whether this is happening during URL Rewriting (doubt it) or when iisnode talks to node.exe.

This does not happen when running node with express directly.

[tjanczuk]

Thanks for the report. This looks like iisnode propagating the URL path that had been normalized by IIS to node.exe. Let me look into this.

[tjanczuk]

The normalization appears to happen in Express.JS itself. Neither URL Rewrite module or iisnode affect the URL path. You can validate this with this simple non-express application:

server.js:

require('http').createServer(function (req, res) {
    res.writeHead(200, {'Content-Type': 'text/html'});
    res.end('path: ' + req.url);
}).listen(process.env.PORT);  

web.config:

<configuration>
  <system.webServer>
    <handlers>
      <add name="iisnode" path="hello.js" verb="*" modules="iisnode" />
    </handlers>
    <rewrite>
      <rules>
        <rule name="myapp">
          <match url="myapp/*" />
          <action type="Rewrite" url="hello.js" />
        </rule>
      </rules>
    </rewrite>    
  </system.webServer>
</configuration>

[mridulsethia]

Hi, How did you resolved this issue? I'm experiencing the same and not able to resolve it.
Thanks for your help.

[andreyselitsky]

I also experience the same issue.

[BarryBotha]

I used a work around by encoding characters myself. In my case input was predictable so I could do it. I'm no longer running on Windows so never pursued this further.

[eugeneagafonov]

I tried this example, and got different behavior when running under iis and under node. They only change i made to the code is adding the default port:

require('http').createServer(function (req, res) {
    res.writeHead(200, {'Content-Type': 'text/html'});
    res.end('path: ' + req.url);
}).listen(process.env.PORT || 3000);  

The response when running node app.js is:
path: /sportbet/BACK/8%2F10/Y

And this is what I get under IIS:
path: /sportbet/BACK/8/10/Y

[richardhuaaa]

@tjanczuk: I was able to replicate the same thing that @eugeneagafonov did, it seems like the problem is not in Express.

Could we maybe try to get #486 in?

[HCanber]

There is a workaround that seems to be working (let's just hope PR #486 gets accepted soon)

When URL Rewrite Module rewrites the url it sets the server variable HTTP_X_ORIGINAL_URL which is what iisnode then uses. The problem is that this is NOT the original url, it is the the decoded version of the original url.
The actual original url is in UNENCODED_URL.

The workaround is then to overwrite HTTP_X_ORIGINAL_URL with UNENCODED_URL before it reaches iisnode which can be done in the rule in web.config with:

<serverVariables>
  <set name="HTTP_X_ORIGINAL_URL" value="{UNENCODED_URL}" />
</serverVariables>

Example:

 <rewrite>
+  <allowedServerVariables>
+    <add name="HTTP_X_ORIGINAL_URL" />
+    <add name="UNENCODED_URL" />
+  </allowedServerVariables>

   <rule name="myapp">
     <match url="myapp/*" />
     <action type="Rewrite" url="hello.js" />
+     <serverVariables>
+       <set name="HTTP_X_ORIGINAL_URL" value="{UNENCODED_URL}" />
+     </serverVariables>
   </rule>
</rewrite>

You might need to unlock the <allowedServerVariables> node in ApplicationHost.config. This file is located in %windir%\system32\inetsrv\config.
Change

<section name="allowedServerVariables" overrideModeDefault="Deny" />

to

<section name="allowedServerVariables" overrideModeDefault="Allow" />

or, better, allow only for YourSite:

    <location path="YourSite" overrideMode="Allow">
        <system.webServer>
            <rewrite>
                <allowedServerVariables />
            </rewrite>
        </system.webServer>
    </location>

About the server variables

The URL Rewrite Module preserves the original requested URL path in the following server variables:

• HTTP_X_ORIGINAL_URL – this server variable contains the original URL in decoded format;
• UNENCODED_URL – this server variable contains the original URL exactly as it was requested by a Web client, with all original encoding preserved.

http://www.iis.net/learn/extensions/url-rewrite-module/url-rewrite-module-configuration-reference#Preserving_Original_URL

[SomaticIT]

@HCanber Did not work for me. I still have %2F converted to slash after adding serverVariables transformation. Do you have any idea ?

[eugeneagafonov]

@SomaticIT are you trying that on Azure? Anyway, run a test nodejs app which prints out UNENCODED_URL server variable. Please ensure that you have the following line in web.config:
<iisnode promoteServerVariables="UNENCODED_URL" />
I'm almost sure that it is encoded as well. This happened to me when trying to configure Azure Web App, seems a load balancer issue.

[SomaticIT]

@eugeneagafonov Yes it's on Azure.

[joaosa]

I'm also experiencing this issue with an Azure web app.