Core: Url length

[rajurh]

Is there a way to set a maxUrlLength configuration value in Asp.Net Core? I see how this is done in web.config in earlier versions of the framework.

I am trying to incorporate the url encryption due to which its exceeding 260 charc and in that case it give bad request for url length greater than 260.

Help on this will be much appreciated.

[Petermarcu]

@DamianEdwards @muratg

[h3smith]

If you are thinking about encrypting URL parameters, don’t. This is a bad security approach and you shouldn’t do it.

[muratg]

@rajurh I agree with @h3smith, there are probably better ways to do what you want. That being said, I think the answer somewhat depends on your setup. Kestrel/HttpSysServer? Behind IIS/nginx or as an edge server? Azure?

cc @halter73 @Tratcher

[rajurh]

@halter73 If you don't want me to encrypt the url what do you suggest I don't want the url to be tampered like for e.g. xyz.com?requestid=121. If its plain any one can change the id's in the browser.

What is your thoughts on the above scenario if you think the above approach is not good?

[muratg]

@rajurh And what's the problem with people changing the ID in the browser?

• If you're trying to hide a resource (from folks putting it's ID a URL in the browser), the right way to do it is through proper access control mechanisms.
• If you're trying to hide it from man-in-the-middle attacks, just use HTTPS.

[h3smith]

People guessing URL parameters should be mitigated by 1) enduring that the user can access the resource defined in the URL parameter 2) never use primary keys as identifiers you send to the world, use guid / random values.

[halter73]

:+1: about it being a bad idea to encrypt URL parameters. Others have already suggested alternative for that.

If there is some other reason you want to increase Kestrel's allowed URL length, you can do so via KestrelServerLimits.MaxRequestLineSize.

As the MaxRequestLineSize doc comments point out, Kestrel already allows URLs approaching 8KB, so I doubt you're actually running into that limit. You're probably running into a limit enforced by either a proxy (e.g. IIS, nginx) or the client/browser.

[Petermarcu]

@rajurh did you get everything you need from the responses? Can we close this issue?

[rajurh]

Yes please goahead

On Sun, Mar 11, 2018 at 9:49 PM, Peter Marcu [e-mail]
wrote:

@rajurh https://github.com/rajurh did you get everything you need from
the responses? Can we close this issue?

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/dotnet/core/issues/1239#issuecomment-372127542, or mute
the thread
https://github.com/notifications/unsubscribe-auth/AO1LQP4iFxKfUCP1KxDGZ08AWnJvIP04ks5tdU6ogaJpZM4RsN1R
.